The DOI matches its Crossref record; 36 of the 36 references it cites were found in a registry or an index; none of the 34 sources its claims cite is checked for support yet.
Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks
Open accessAbstract
The BATtle of the Attack Detection ALgorithms (BATADAL) is the most recent competition on planning and management of water networks undertaken within the Water Distribution Systems Analysis Symposium. The goal of the battle was to compare the performance of algorithms for the detection of cyber-physical attacks, whose frequency has increased in the last few years along with the adoption of smart water technologies. The design challenge was set for the C-Town network, a real-world, medium-sized water distribution system operated through programmable logic controllers and a supervisory control and data acquisition (SCADA) system. Participants were provided with data sets containing (simulated) SCADA observations, and challenged to design an attack detection algorithm. The effectiveness of all submitted algorithms was evaluated in terms of time-to-detection and classification accuracy. Seven teams participated in the battle and proposed a variety of successful approaches leveraging data analysis, model-based detection mechanisms, and rule checking. Results were presented at the Water Distribution Systems Analysis Symposium (World Environmental and Water Resources Congress) in Sacramento, California on May 21–25, 2017. This paper summarizes the BATADAL problem, proposed algorithms, results, and future research directions.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
BATADAL was a competition comparing seven attack-detection algorithms on simulated SCADA data from the C-Town water distribution network under cyber-physical attacks. The winning model-based approach by Housh and Ohar achieved the best overall ranking score (S = 0.970), while most algorithms outperformed naïve detection baselines.
Key findings
- Seven teams participated; all but one achieved a ranking score S > 0.75, better than naïve detection mechanisms.
- Housh and Ohar ranked first with S = 0.970, S_TTD = 0.965, S_CLF = 0.975, detecting all 7 test attacks; Abokifa et al. ranked second with S = 0.949.
- The only model-based approach won: estimating water demands, simulating system dynamics with EPANET, and measuring errors against SCADA readings proved successful.
- Aghashahi et al. ranked last with S = 0.534 and detected only 3 attacks; Chandy et al. was over-sensitive with many false alarms, while Pasha et al. lacked sensitivity.
Methods
- Design challenge used the C-Town network: 429 pipes, 388 junctions, 7 storage tanks, 11 pumps, 5 valves, 1 reservoir, and 9 PLCs coordinated by SCADA.
- Participants received three simulated SCADA datasets: Training dataset 1 with no attacks over 365 days at hourly time steps; Training dataset 2 with seven attacks over 492 hourly time steps; and a Test dataset with seven attacks over 407 hourly time steps.
- Algorithms were evaluated by time-to-detection (S_TTD), classification performance (S_CLF = mean of TPR and TNR), and overall ranking score S = 0.5·S_TTD + 0.5·S_CLF.
Limitations
- The paper states the evaluation was deterministic on three specific datasets representing only a small portion of possible cyber-attacks; robustness would require stochastic scenarios with varying hydraulic conditions and multiple attack sequences.
- The paper states a major limitation is the absence of detailed real SCADA data on cyber attacks to water utilities, and that BATADAL relied on data generated with a demand-driven engine.
- Evident from the text: participants were given the same computational model of C-Town used to generate the SCADA data, and demand patterns were fairly regular and consistent across datasets, which may limit real-world applicability.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
22 No full text of the sources · 14 Own interpretation · 8 No basis given · 5 Sources not found · 4 Own method · 3 Own result · 2 Not checked yet
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Interestingly, the BATADAL was won by the only model-based approach.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“With a value of S equal to 0.896, the algorithm proposed by Brentan et al. (2017) can also be regarded as a strong performer.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
- Not checked — no full text of the sourcecites Brentan et al. (2017) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In this regard, it is important to note that BATADAL demand patterns were fairly regular and consistent across the three datasets.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that a naïve detection mechanism that predicts the system to be always in safe conditions gets a score S equal to 0.25 (S T T D = 0, S CLF = 0.5).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Ranking score
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“The algorithm ofAbokifa et al. (2017) comes a close second, with S equal to 0.949.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > SUPPLEMENTAL DATA
What the sources say
- Not checked — no full text of the sourcecites Abokifa et al. (2017) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A claim is checked only against the cited paper’s full text, never its abstract, and none is available for its sources.
In the paper
“With the exception of Brentan et al. (2017) and Pasha et al. (2017), there appears to be a strong correlation between these two metrics (see Fig -ure 3).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
What the sources say
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“The group is led by the algorithm proposed byHoush and Ohar (2017b), which shows the best overall performance (S = 0.970).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > SUPPLEMENTAL DATA
What the sources say
- Not matchedcites Housh and Ohar (2017b)
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
In the paper
“As shown in Figure 4(b), Abokifa et al. (2017) algorithm disclosed Attack #10 and #11 as a single continuous episode, erroneously flagging the system as under attack for the period in between.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
- Not checked — no full text of the sourcecites Abokifa et al. (2017) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Only a few algorithms provided information on the attacked devices.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A claim is checked only against the cited paper’s full text, never its abstract, and none is available for its sources.
In the paper
“Among these, the algorithms proposed by Brentan et al. (2017) and Giacomoni et al. (2017) were the most accurate.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
What the sources say
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- It may state two separate claims as one. 20
- Probably not a substantial claim. 20
In the paper
“As shown in Figure 4(d), this algorithm was able to consistently and accurately detect most of the attacks, but it failed to identify the last one.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
- Not checked — no full text of the sourcecites Brentan et al. (2017) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“However, Giacomoni et al. (2017) algorithm is less sensitive, resulting in a higher number of false negatives and minor timing errors (see Figure 4(c)) that lead to a score S equal to 0.927.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
- Not checked — no full text of the sourcecites Giacomoni et al. (2017) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A claim is checked only against the cited paper’s full text, never its abstract, and none is available for its sources.
In the paper
“Their score S is equal to 0.802 and 0.773, respectively.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“On the other hand, the algorithm of Pasha et al. (2017) issued just a few false alarms, but it lacked sensitivity, thus failing to flag the system as under attack for the entire duration of the events.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
- Not checked — no full text of the sourcecites Pasha et al. (2017) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Indeed, the detection trajectory depicted in Figure4(a) shows that all attacks were immediately detected, with the exception of the last one, which was disclosed a few hours after its starting time.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > SUPPLEMENTAL DATA
What the sources say
- Not matchedcites Housh and Ohar (2017b)
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
None of the sources cited for this claim have been checked yet.
In the paper
“The algorithm proposed by Giacomoni et al. (2017) has the same number of false positives and true negatives as that of Housh and Ohar (2017b)-meaning that both algorithms were the most successful in avoiding false alarms.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
- Not checked — no full text of the sourcecites Giacomoni et al. (2017) source
- Not matchedcites Housh and Ohar (2017b)
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Note that this algorithm is the top scorer in terms of both time-to-detection S T T D and classification score S CLF .”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > SUPPLEMENTAL DATA
What the sources say
- Not matchedcites Housh and Ohar (2017b)
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“since the number of attacks in the available data is generally limited.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
In the paper
“The algorithm of Chandy et al. (2017) turned out to be over-sensitive-meaning that it was able to identify most of the attack instances, but at the cost of issuing numerous false alarms.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
- Not checked — no full text of the sourcecites Chandy et al. (2017) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Seven teams participated in the battle and proposed a variety of successful approaches leveraging data analysis, model-based detection mechanisms, and rule checking.”
- Also stated in: § ATTACK DETECTION ALGORITHMS · plain
“Seven teams participated in BATADAL.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Also stated in: § ATTACK DETECTION ALGORITHMS · plain
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“All algorithms but one achieved a ranking score S larger than 0.75, meaning that they performed better than naïve detection mechanisms.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“On the other hand, flagging the system as always under attack yields a value of S equal to 0.75 (S T T D = 1, S CLF = 0.5).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Ranking score
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
None of the sources cited for this claim have been checked yet.
In the paper
“The definition of the cut-off criteria defining outliers regulates the trade-off between True Positive and True Negative Rate for most of the algorithms”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > FUTURE RESEARCH DIRECTIONS
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Finally, the contribution of Aghashahi et al. (2017) detected only three attacks, leading to a score S equal to 0.534.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
What the sources say
- Not checked — no full text of the sourcecites Aghashahi et al. (2017) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Most teams presented multi-stage detection methods.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Protecting water distribution systems from cyber attacks requires (as with other cyberphysical systems) a combination of proactive and reactive mechanisms (Cardenas et al. 2008).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > INTRODUCTION
What the sources say
- Not checked — no full text of the sourcecites Cardenas et al. 2008 source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim could be matched to a paper in Crossref, so there is nothing to check it against.
In the paper
“according to which the number of reported attacks on water infrastructures has been growing steadily (ICS-CERT 2014; ICS-CERT 2015; ICS-CERT 2016)-making them the third highest targeted sector after critical manufacturing and energy (ICS-CERT 2016).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > INTRODUCTION
What the sources say
- Not matchedcites ICS-CERT 2014
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites ICS-CERT 2015
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites ICS-CERT 2016
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
In the paper
“The adoption of such smart water technologies plays a pivotal role in enhancing the reliability and autonomy of water distribution systems, but simultaneously exposes them to cyber-physical attacks (Rasekh et al. 2016)”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > INTRODUCTION
What the sources say
- Not checked — no full text of the sourcecites Rasekh et al. 2016 source
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This means that the information provided by SCADA systems may not be fully reliable.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > INTRODUCTION
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: All networked devices, including SCADA systems, represent potential targets.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Comparing and confirming the detection issued by different modules can help decrease classification errors.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We can probably conclude that both model-based and data-driven approaches are suitable for attack detection problems, although their performance would probably vary with the modelling context at hand.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“While the data and algorithms presented here provide a first step towards an objective comparison of attack detection algorithms for water distribution systems, they do not represent the entire spectrum of modelling contexts that practitioners and researchers would encounter.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > CLOSURE
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since attack detection mechanisms aim to disclose outliers and contextual anomalies in the system behavior, they may accidentally disclose anomalous behaviors that are not necessarily caused by cyber attacks.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > FUTURE RESEARCH DIRECTIONS
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“The latter were aimed at manipulating the information sent or received by sensors and PLCs, with the ultimate goal of affecting the operations of an actuator (Urbina et al. 2016).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Development data
What the sources say
- Not checked — no full text of the sourcecites Urbina et al. 2016 source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“The evaluation of BATADAL algorithms can be seen as a deterministic analysis carried out on three specific datasets, which represent only a small portion of the entire set of cyber-attacks that could threaten a water distribution system.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > FUTURE RESEARCH DIRECTIONS
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“The first two datasets, hereafter named Training dataset 1 and Training dataset 2, were provided at the beginning of the competition, while the third one (Test dataset) was subsequently used to evaluate and rank the attack detection algorithms.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Development data
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Both time-to-detection and classification score are important aspects of performance.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This is a rather challenging task due to the intrinsic correlation among the hydraulic variables.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > FUTURE RESEARCH DIRECTIONS
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The solutions provided by seven teams suggest that timely and accurate detection can be obtained by both modelbased and data-driven approaches, usually made of multiple sequential stages.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > CLOSURE
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“SCADA concealment was performed by either replacing actual traffic information between PLCs and SCADA with previously-recorded data (replay attacks) or adding an offset to the transmitted sensor readings (Urbina et al. 2016).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Development data
What the sources say
- Not checked — no full text of the sourcecites Urbina et al. 2016 source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“A limitation of this battle is its reliance of data generated with a demand-driven engine (Taormina et al. 2017).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > FUTURE RESEARCH DIRECTIONS
What the sources say
- Not checked — no full text of the sourcecites Taormina et al. 2017 source
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“It appears that consistency checks and the analysis of control rules should lead to the identification of the simplest attacks.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“A key aspect of the dataset is the absence of cyber attacks, which made it suitable for studying the operations of the water distribution system under normal operating conditions.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Development data
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The operations of the water system were altered through malicious activation of hydraulic actuators, change of actuator settings, and deception attacks-amongst the most common for cyber-physical systems (Cardenas et al. 2009).”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Development data
What the sources say
- Not matchedcites Cardenas et al. 2009
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The inherent interdependence of the elements in the water network should theoretically allow for the detection of anomalies, even when the adversary tries to conceal his (her) actions by altering the SCADA readings of one or a few deployed sensors.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > General Observations
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper relies on this without support.
All networked devices, including SCADA systems, represent potential targets.
“Third, all networked devices, including SCADA systems, represent potential targets.”
The paper relies on this without support.
It is not possible to rule out all attacks.
“Since it is not possible to rule out all attacks, cyber-physical systems should also be equipped with intrusion detection schemes that assist with the recovery phase (Anderson 2010).”
The paper relies on this without support.
The simulated SCADA data and attacks in the BATADAL datasets adequately represent real-world cyber-physical attacks on water distribution networks.
“Participants were provided with datasets containing (simulated) SCADA observations, and challenged with the design of an attack detection algorithm.”
“The datasets were generated via simulation with epanetCPA, a Matlab toolbox that allows to design a variety of cyber attacks and simulate, with EPANET2 (version 2.0.12), the hydraulic response of a water distribution network; see Taormina et al. (2017) for further details.”
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > Algorithms performance
“With a value of S equal to 0.896, the algorithm proposed by Brentan et al. (2017) can also be regarded as a strong performer.”
§ THE BATTLE OF THE ATTACK DETECTION ALGORITHMS 1 > SUPPLEMENTAL DATA
“| 4 | Brentan et al. | 6 | 0.894 0.857 0.931 362 45 1637 45 | | |”
Citations
Cites
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Auto-Encoding Variational Bayes
Kingma, D. P., & Welling, M. (2013) · arXiv · doi:10.48550/arxiv.1312.6114 · Cited by 20,067
A systematic analysis of performance measures for classification tasks
Sokolova, M., & Lapalme, G. (2009) · Information Processing & Management · doi:10.1016/j.ipm.2009.03.002 · Cited by 7,515
Tutorial on Variational Autoencoders
Doersch, C. (2016) · arXiv · doi:10.48550/arxiv.1606.05908 · Cited by 1,470
Diagnosing network-wide traffic anomalies
Lakhina, A., Crovella, M., & Diot, C. (2004) · Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication · doi:10.1145/1015467.1015492 · Cited by 1,399
Secure Control: Towards Survivable Cyber-Physical Systems
Cardenas, A. A., Amin, S., & Sastry, S. (2008) · 2008 The 28th International Conference on Distributed Computing Systems Workshops · doi:10.1109/icdcs.workshops.2008.40 · Cited by 911
Event detection from time series data
Guralnik, V., & Srivastava, J. (1999) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/312129.312190 · Cited by 480
Security Engineering: A Guide to Building Dependable Distributed Systems
Anderson, R. (2020) · doi:10.1002/9781119644682 · Cited by 345
Anomaly Detection via Online Oversampling Principal Component Analysis
Lee, Y., Yeh, Y.-R., & Wang, Y.-C. F. (2013) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2012.99 · Cited by 225
An evaluation framework for input variable selection algorithms for environmental data-driven models
Galelli, S., Humphrey, G. B., Maier, H. R., Castelletti, A. F., Dandy, G. C., & Gibbs, M. S. (2014) · Environmental Modelling & Software · doi:10.1016/j.envsoft.2014.08.015 · Cited by 208
Self-citation
Research works printed but not linked: 2
- Cardenas A. S. Amin B. Sinopoli A. Giani A. Perrig and S. Sastry. 2009. “Challenges for securing cyber physical systems.” In Vol. 5 of Proc. Workshop on Future Directions in Cyber-Physical Systems Security. Washington DC: Department of Homeland Security.
- Rossman L. A., 2000, EPANET 2 users manual
Cited by
Sorted by citations
Tyralis, H., Papacharalampous, G., & Langousis, A. (2019) · Water · doi:10.3390/w11050910 · Cited by 828
The role of deep learning in urban water management: A critical review
Fu, G., Jin, Y., Sun, S., Yuan, Z., & Butler, D. (2022) · Water Research · doi:10.1016/j.watres.2022.118973 · Cited by 479
“…14 attack scenarios considering various components such as pumps, tanks and controllers in a benchmark water distribution system (i.e., C-Town), and results showed autoencoders substantially outperform traditional machine learning methods, i.e., XGBoost and LightGBM (Taormina and Galelli, 2018).”
BackgroundMethodInfluentialAn Ensemble Deep Learning-Based Cyber-Attack Detection in Industrial Control System
Al-Abassi, A., Karimipour, H., Dehghantanha, A., & Parizi, R. M. (2020) · IEEE Access · doi:10.1109/access.2020.2992249 · Cited by 323
“While the security concerns of critical infrastructure facilities are already considered in the IT community, limited efforts have been made to develop security solutions that are specific to ICSs and OT environments [9].”
BackgroundA Survey on Industrial Control System Testbeds and Datasets for Security Research
Conti, M., Donadel, D., & Turrin, F. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3094360 · Cited by 284
Kravchik, M., & Shabtai, A. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3050101 · Cited by 224
“Figure 7 shows that the status of the valve was not replayed, although the authors of [37] reported that it was.”
BackgroundMethodInfluentialBlock Hunter: Federated Learning for Cyber Threat Hunting in Blockchain-Based IIoT Networks
Yazdinejad, A., Dehghantanha, A., Parizi, R. M., Hammoudeh, M. A. A., Karimipour, H., & Srivastava, G. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3168011 · Cited by 215
“They are well fit for the IIoT environments and are publicly available [32], [33].”
A Review of Cybersecurity Incidents in the Water Sector
Hassanzadeh, A., Rasekh, A., Galelli, S., Aghashahi, M., Taormina, R., Ostfeld, A., & Banks, M. K. (2020) · Journal of Environmental Engineering · doi:10.1061/(asce)ee.1943-7870.0001686 · Cited by 195
Self-citationAn ensemble deep learning model for cyber threat hunting in industrial internet of things
Yazdinejad, A., Kazemi, M., Parizi, R. M., Dehghantanha, A., & Karimipour, H. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.09.008 · Cited by 181
Smart Water Technology for Efficient Water Resource Management: A Review
Gupta, A. D., Pandey, P., Feijóo, A., Yaseen, Z. M., & Bokde, N. D. (2020) · Energies · doi:10.3390/en13236268 · Cited by 190
“Laws need to be created by governments, which will restrict the industry from misusing the personal data by firms or through cyber-attack [114].”
BackgroundOberascher, M., Rauch, W. A., & Sitzenfrei, R. (2021) · Sustainable Cities and Society · doi:10.1016/j.scs.2021.103442 · Cited by 179
Machine Learning-based Intrusion Detection for Smart Grid Computing: A Survey
Sahani, N., Zhu, R., Cho, J.-H., & Liu, C. (2023) · ACM Transactions on Cyber-Physical Systems · doi:10.1145/3578366 · Cited by 192
“The public dataset, such as BATADAL [112], SWaT [43], and WADI [4], focus on a SCADA system in the power grid and cannot provide the specific features related to power system measurements and protocols or new smart devices (e.g., smart inverters, IEDs, and communication infrastructure).”
MethodAPT datasets and attack modeling for automated detection methods: A review
Stojanović, B., Hofer-Schmitz, K., & Kleb, U. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101734 · Cited by 147
Multi-Agent Systems and Complex Networks: Review and Applications in Systems Engineering
Herrera, M., Hernández, M. P., Parlikad, A. K., & Izquierdo, J. (2020) · Processes · doi:10.3390/pr8030312 · Cited by 143
“Among other advantages, Candelieri et al. [231] highlighted that the cyber-physical water system is key for more efficient water distribution network management, hydraulic performance, and optimised network protection [164].”
BackgroundSelf-citationA Systematic Review of the State of Cyber-Security in Water Systems
Tuptuk, N., Hazell, P., Watson, J., & Hailes, S. (2021) · Water · doi:10.3390/w13010081 · Cited by 138
“…for research in cyber-security at Singapore University of Technology and Design [46], and the BATADAL (BATtle of the Attack Detection Algorithms) competition organised by iTrust center and their international collaborators [47] to detect cyber-attacks against water distribution systems (WSD).”
BackgroundInfluentialTaormina, R., & Galelli, S. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000983 · Cited by 139
Self-citationBattle of the Leakage Detection and Isolation Methods
Vrachimis, S. G., Eliades, D. G., Taormina, R., et al. (2022) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001601 · Cited by 129
Self-citationKoay, A. M. Y., Ko, R. K. L., Hettema, H., & Radke, K. (2023) · Journal of Intelligent Information Systems · doi:10.1007/s10844-022-00753-1 · Cited by 131
“BATtle of the Attack Detection Algorithms (BATADAL) datasets (Taormina et al., 2018) consist of three different simulated datasets based on a fictional C-Town water distribution system.”
BackgroundMethodOn the Generation of Anomaly Detection Datasets in Industrial Control Systems
Gómez, Á. L. P., Maimó, L. F., Celdrán, A. H., Clemente, F. J. G., Sarmiento, C. C., Masa, C. D. C., & Nistal, R. M. (2019) · IEEE Access · doi:10.1109/access.2019.2958284 · Cited by 120
“It is also worth mentioning the BATADAL [24] (BATtle of the Attack Detection ALgorithms) competition, which is carried out to propose algorithms for the detection of cyber-attacks affecting industrial environments.”
BackgroundA survey of machine learning methods applied to anomaly detection on drinking-water quality data
Dogo, E. M., Nwulu, N. I., Twala, B., & Aigbavboa, C. O. (2019) · Urban Water Journal · doi:10.1080/1573062x.2019.1637002 · Cited by 122
“AE is also proposed in the domain of WDS (Taormina and Galelli 2018, 4018065; Chandy et al. 2019, 4018093).”
BackgroundDigital Twin-based Anomaly Detection in Cyber-physical Systems
Xu, Q., Ali, S., & Yue, T. (2021) · IEEE Conference on Software Testing, Verification and Validation (ICST) · doi:10.1109/icst49551.2021.00031 · Cited by 108
“…from real-world critical infrastructure testbeds: Secure Water Treatment (SWaT) [7]— a multi-stage water purification plant, Water Distribution (WADI) [8]— a consumer distribution network, and Battle of Attack Detection Algorithms (BATADAL) [9]— a dataset designed for an attack detection contest.”
BackgroundMethodMachine learning model and strategy for fast and accurate detection of leaks in water supply network
Fan, X., Zhang, X., & Yu, X. B. (2021) · Journal of Infrastructure Preservation and Resilience · doi:10.1186/s43065-021-00021-6 · Cited by 96
Abokifa, A. A., Haddad, K., Lo, C. S., & Biswas, P. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001023 · Cited by 90
Self-citationAttack detection in water distribution systems using machine learning
Ramotsoela, D. T., Hancke, G. P., & Abu-Mahfouz, A. M. I. (2019) · Human-centric Computing and Information Sciences · doi:10.1186/s13673-019-0175-8 · Cited by 82
“The BATADAL competition involved a number of research teams who proposed attack detection algorithms for the fictional C-Town water distribution network [22].”
BackgroundMethodInfluentialSmart urban water systems: what could possibly go wrong?
de Vitry, M. M., Schneider, M. Y., Wani, O., Manny, L., Leitão, J. P., & Eggimann, S. (2019) · Environmental Research Letters · doi:10.1088/1748-9326/ab3761 · Cited by 81
“As illustrated by Taormina et al [17] for water distribution networks, the analysis of network monitoring data alone could allow cyberattacks to be detected.”
BackgroundReview of Modeling Methodologies for Managing Water Distribution Security
Berglund, E. Z., Pesantez, J. E., Rasekh, A., Shafiee, M. E., Perelman, L., & Haxton, T. (2020) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001265 · Cited by 77
Self-citationErba, A., Taormina, R., Galelli, S., Pogliani, M., Carminati, M., Zanero, S., & Tippenhauer, N. O. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427660 · Cited by 97
Self-citationSmart Technologies for Sustainable Water Management: An Urban Analysis
Aivazidou, E., Banias, G., Lampridi, M., et al. (2021) · Sustainability · doi:10.3390/su132413940 · Cited by 76
“other legal issues, indicatively referring to big data use, should be also studied to safeguard the reliability and viability of smart urban water management systems [72,73].”
BackgroundA survey of water utilities’ digital transformation: drivers, impacts, and enabling technologies
Daniel, I., Ajami, N., Castelletti, A. F., Savic, D. A., Stewart, R. A., & Cominola, A. (2023) · npj Clean Water · doi:10.1038/s41545-023-00265-7 · Cited by 85
Bakalos, N., Voulodimos, A. S., Doulamis, N. D., Doulamis, A. D., Ostfeld, A., Salomons, E., Caubet, J., Jimenez, V., & Li, P. (2019) · IEEE Signal Processing Magazine · doi:10.1109/msp.2018.2885359 · Cited by 75
“The related results are summarized in [18], while the most successful method of the competition was based on understanding the physical behavior of the water distribution system operation, combined with an anomaly-detection technique [2].”
MethodSelf-citationA toolbox for assessing the impacts of cyber-physical attacks on water distribution systems
Taormina, R., Galelli, S., Douglas, H., Tippenhauer, N. O., Salomons, E., & Ostfeld, A. (2018) · Environmental Modelling & Software · doi:10.1016/j.envsoft.2018.11.008 · Cited by 68
Self-citationLee, C. W., & Yoo, D.-G. (2021) · Sustainability · doi:10.3390/su13169262 · Cited by 63
“[5] presented data-based pipe breakage detection methods to detect the effects of pipe breakage through classification-based, prediction-classification-based, and statistical methods with a focus on whether or not predictions are included.”
MethodDeep Machine Learning Model-Based Cyber-Attacks Detection in Smart Power Systems
Almalaq, A., Albadran, S. M., & Mohamed, M. A. (2022) · Mathematics · doi:10.3390/math10152574 · Cited by 63
Intrusion and anomaly detection for the next-generation of industrial automation and control systems
Rosa, L., Cruz, T., de Freitas, M. B., Quitério, P., Henriques, J., Caldeira, F., Monteiro, E., & Simões, P. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2021.01.033 · Cited by 63
“The authors run their model against the BATADAL dataset [83], allowing to perform comparisons with publicly available re-sults using the same data.”
MethodGraph Neural Networks for Pressure Estimation in Water Distribution Systems
Truong, H., Tello, A., Lazovik, A., & Degeler, V. (2024) · Water Resources Research · doi:10.1029/2023wr036741 · Cited by 76
“Its application is crucial for subsequent management tasks, including leak localization (Mücke et al., 2023), optimal control (Martínez et al., 2007), and cyber‐attack detection (Taormina et al., 2018).”
Daniel, I., Pesantez, J. E., Letzgus, S., et al. (2022) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001535 · Cited by 55
“(21) and Taormina et al. (2018)] and the volume of water leaked V leaked from the start time of the leak t start until the time of detection t d Finally, we compute the aggregate economic score S defined by the BattLeDIM organizers as to account for the trade-off between the benefits p iw (i.e.,…”
MethodAI for DevSecOps: A Landscape and Future Opportunities
Fu, M. C., Pasuksmit, J., & Tantithamthavorn, C. K. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3712190 · Cited by 94
A Survey of Cyber-Physical Attacks and Detection Methods in Smart Water Distribution Systems
Addeen, H. H., Xiao, Y., Li, J., & Guizani, M. (2021) · IEEE Access · doi:10.1109/access.2021.3095713 · Cited by 53
“In recent years, there are some detection approaches to detect the attacks and mitigate the impacts of the attacks in WDS such as statistical detection methods, artificial neural network methods, machine learning algorithms, etc. [21].”
BackgroundOverview of Energy Management and Leakage Control Systems for Smart Water Grids and Digital Water
Giudicianni, C., Herrera, M., Nardo, A. D., Adeyeye, K., & Ramos, H. M. (2020) · Modelling—International Open Access Journal of Modelling in Engineering Science · doi:10.3390/modelling1020009 · Cited by 47
“Further, an increasingly automated and interconnected world creates new sources of vulnerability, such as cyber-attacks to their automated system management [104,105] or the increasing likelihood of failure propagation through multiple, urban infrastructures [106].”
BackgroundSelf-citationDigital Twin-based Anomaly Detection with Curriculum Learning in Cyber-physical Systems
Xu, Q., Ali, S., & Yue, T. (2023) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3582571 · Cited by 49
“We evaluate LATTICE with five CPS datasets, namely Secure Water Treatment (SWaT) [39], Water Distribution (WADI) [1], Battle Of The Attack Detection Algorithms (BATADAL) [52], PHM challenge 2015 dataset [25], and Gas Pipeline Dataset [40].”
MethodModelling cyber resilience in a water treatment and distribution system
Patriarca, R., Simone, F., & Gravio, G. D. (2022) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2022.108653 · Cited by 43
Poisoning attacks on cyber attack detectors for industrial control systems
Kravchik, M., Biggio, B., & Shabtai, A. (2021) · ACM Symposium on Applied Computing · doi:10.1145/3412841.3441892 · Cited by 43
Balla, A., Habaebi, M. H., Islam, M. R., & Mubarak, S. (2022) · Cleaner Engineering and Technology · doi:10.1016/j.clet.2022.100532 · Cited by 48
Landauer, M., Skopik, F., Stojanović, B., Flatscher, A., & Ullrich, T. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00921-0 · Cited by 71
“Stojanovic et al. [114] propose a deep learning based method for detection of attacks in water distribution environment, utilising BATADAL [116], a collection of sensor readings.”
Cyber-Physical Systems for Water Supply Network Management: Basics, Challenges, and Roadmap
Adedeji, K. B., & Hamam, Y. (2020) · Sustainability · doi:10.3390/su12229555 · Cited by 41
Tsiami, L., & Makropoulos, C. (2021) · Water · doi:10.3390/w13091247 · Cited by 41
“In the face of a potential cyber-attack, one of the emerging fields of ongoing research focuses on the early detection of attacks [5].”
InfluentialCyberattack Detection Using Deep Generative Models with Variational Inference
Chandy, S. E., Rasekh, A., Barker, Z. A., & Shafiee, M. E. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001007 · Cited by 41
“According to BATADAL (Taormina et al. 2018), Attack 6 is created by two simultaneous actions: an attack and a concealment.”
BackgroundMethodInfluentialSelf-citationReal-Time SCADA Attack Detection by Means of Formal Methods
Mercaldo, F., Martinelli, F., & Santone, A. (2019) · IEEE International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE) · doi:10.1109/wetice.2019.00057 · Cited by 39
“, ψ, is related to the underflow attack (both overflow and underflow in the tank measurements can be symptomatic of a cyber attack in progress [3]).”
BackgroundBattle of Postdisaster Response and Restoration
Páez, D., Filion, Y., Castro-Gama, M. E., et al. (2020) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001239 · Cited by 35
Self-citationMahmoud, H., Wu, W., & Gaber, M. M. (2022) · Energies · doi:10.3390/en15030914 · Cited by 38
Investigation of Cyber Attacks on a Water Distribution System
Adepu, S., Palleti, V. R., Mishra, G., & Mathur, A. P. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-61638-0_16 · Cited by 33
MAD-SGCN: Multivariate Anomaly Detection with Self-learning Graph Convolutional Networks
Qi, P., Li, D., & Ng, S.-K. (2022) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde53745.2022.00097 · Cited by 32
Shin, S., Lee, S., Burian, S. J., Judi, D. R., & McPherson, T. N. (2020) · Journal of Environmental Engineering · doi:10.1061/(asce)ee.1943-7870.0001665 · Cited by 32
Deep H2O: Cyber attacks detection in water distribution systems using deep learning
Sikder, M. N. K., Nguyen, M. B. T., Elliott, E. D., & Batarseh, F. A. (2023) · Journal of Water Process Engineering · doi:10.1016/j.jwpe.2023.103568 · Cited by 37
Reducing Vulnerability to Cyber-Physical Attacks in Water Distribution Networks
Nicolaou, N., Eliades, D. G., Panayiotou, C. G., & Polycarpou, M. M. (2018) · International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater) · doi:10.1109/cyswater.2018.00011 · Cited by 31
Self-citationResilience Assessment of Water Quality Sensor Designs under Cyber-Physical Attacks
Nikolopoulos, D., Ostfeld, A., Salomons, E., et al. (2021) · Water · doi:10.3390/w13050647 · Cited by 29
Self-citationCyber-Attack Detection in Water Distribution Systems Based on Blind Sources Separation Technique
Brentan, B., de Rezende, P. J., Barros, D. B., Meirelles, G., Luvizotto, E., & Izquierdo, J. (2021) · Water · doi:10.3390/w13060795 · Cited by 30
“This fact corroborates the accuracy of the algorithm, mainly in terms of false positives minimization, since according to [7], there were no attacks occurring in the test data set.”
BackgroundMethodInfluentialSelf-citationFung, C., Srinarasi, S., Lucas, K., Phee, H. B., & Bauer, L. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17143-7_24 · Cited by 32
“These datasets cover a variety of domains, including water distribution [4,33], water treatment [10], gas pipelines [24], and power generation [3,28].”
BackgroundMethodBehavioural Intrusion Detection in Water Distribution Systems Using Neural Networks
Ramotsoela, D. T., Hancke, G. P., & Abu-Mahfouz, A. M. I. (2020) · IEEE Access · doi:10.1109/access.2020.3032251 · Cited by 28
“RESULTS In this sections the results of the neural network architectures presented in the previous sections are evaluated using the BATADAL dataset [27].”
BackgroundMethodCo-Simulating Physical Processes and Network Data for High-Fidelity Cyber-Security Experiments
Murillo, A., Taormina, R., Tippenhauer, N. O., & Galelli, S. (2020) · Annual Industrial Control System Security Workshop (ICSS) · doi:10.1145/3442144.3442147 · Cited by 29
“It is a well-known benchmark in the domain of water system analysis, where it has been used for a variety of tasks, ranging from model calibration [21] to cyber attack detection [25].”
BackgroundSelf-citationAbokifa, A. A., Maheshwari, A., Gudi, R. D., & Biswas, P. (2019) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001125 · Cited by 27
Self-citationResilience for Smart Water Systems
Marchese, D., Jin, A. S., Fox‐Lent, C., & Linkov, I. (2019) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001130 · Cited by 27
Paredes, C. M., Martínez-Castro, D., Ibarra‐Junquera, V., & González, A. (2021) · Electronics · doi:10.3390/electronics10182238 · Cited by 28
“Two test benches were used to evaluate the performance of the proposed architecture, the SWaT dataset [77,78] and an interconnected tank [58].”
MethodProbabilistic State Estimation in Water Networks
Wang, S., Taha, A. F., Gatsis, N., Perelman, L., & Giacomoni, M. H. (2021) · IEEE Transactions on Control Systems Technology · doi:10.1109/tcst.2021.3066102 · Cited by 28
“uncertainty such as cyber-attacks to SCADA systems [8], [9]”
BackgroundSelf-citationZhang, D., Wang, M., Bu, Y., Yu, J., & Yang, L. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104210 · Cited by 24
Pressure-Driven Modeling of Cyber-Physical Attacks on Water Distribution Systems
Douglas, H., Taormina, R., & Galelli, S. (2019) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001038 · Cited by 25
Self-citationTemporal pattern-based malicious activity detection in SCADA systems
Shlomo, A., Kalech, M., & Moskovitch, R. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102153 · Cited by 23
Active Contamination Detection in Water-Distribution Systems
Vrachimis, S. G., Lifshitz, R., Eliades, D. G., et al. (2020) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001176 · Cited by 23
Self-citationWu, Z. Y., & He, Y. (2021) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001433 · Cited by 22
Sharmeen, S., Huda, S., Abawajy, J., Ahmed, C. M., Hassan, M. M., & Fortino, G. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3100461 · Cited by 22
Fiedler, F., Cominola, A., & Lucia, S. (2020) · IFAC-PapersOnLine · doi:10.1016/j.ifacol.2020.12.793 · Cited by 21
“C-Town is a benchmark medium-sized network first introduced by Ostfeld (2012) and later used in other state-of-the-art studies (e.g. Sousa et al., 2016; Taormina, 2018).”
MethodErba, A., & Tippenhauer, N. O. (2022) · Annual Computer Security Applications Conference · doi:10.1145/3564625.3564633 · Cited by 20
“Datasets to evaluate detection schemes are collections of sensor readings and actuator states recorded from ICS testbed or process simulation [16, 23, 32, 42].”
BackgroundMethodInfluentialSelf-citationA CVAE-Based Anomaly Detection Algorithm for Cyber Physical Attacks for Water Distribution Systems
Addeen, H. H., Xiao, Y., & Li, T. (2024) · IEEE Access · doi:10.1109/access.2024.3384295 · Cited by 22
“Also, a CPA can change the data of components to disrupt the operation, such as changing the water level in a water tank to overflow and waste the water [3].”
BackgroundMethodInfluentialShekofteh, M. R., Yousefi-Khoshqalb, E., & Piratla, K. R. (2023) · Water Resources Management · doi:10.1007/s11269-023-03592-z · Cited by 19
“Water supply reliability is a pressing concern due to urbanization, increasing water demands, spatio-temporal disruptions, cyber-physical threats, and climate change impacts (Ashraf et al. 2019; Özerol et al. 2020; Taormina et al. 2018).”
BackgroundSecure Authentication and Trust Management Scheme for Edge AI-Enabled Cyber-Physical Systems
Xiang, X., Cao, J. P., & Fan, W. (2025) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2025.3529691 · Cited by 20
“In contrast, the accuracy of the LSTM algorithm is better in [32] and [33].”
InfluentialPractical Evaluation of Poisoning Attacks on Online Anomaly Detectors in Industrial Control Systems
Kravchik, M., Demetrio, L., Biggio, B., & Shabtai, A. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102901 · Cited by 18
“In [24], the authors present a successful evasion of both NN detector and additional rules checkers in CPSs with the help of genetic algorithms evaluated on two public datasets.”
BackgroundMethodInfluentialDetecting Cyber-Physical Attacks in Water Distribution Systems: One-Class Classifier Approach
Kadosh, N., Frid, A., & Housh, M. (2020) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001259 · Cited by 19
Self-citationAdaptive DMA Design and Operation under Multiscenarios in Water Distribution Networks
Bui, X. K., Jeong, G., & Kang, D. (2022) · Sustainability · doi:10.3390/su14063692 · Cited by 17
“Moreover, cyber-physical threats to the WDN pose a major concern and drive human lives toward risk [4].”
BackgroundTime Series Anomaly Detection with Variational Autoencoder Using Mahalanobis Distance
Gjorgiev, L., & Gievska, S. (2020) · Communications in computer and information science · doi:10.1007/978-3-030-62098-1_4 · Cited by 21
Choi, Y. H., Sadollah, A., & Kim, J. H. (2020) · Applied Sciences · doi:10.3390/app10228179 · Cited by 18
“Furthermore, this study used a dataset from the Battle of the Attack Detection Algorithms (BATADAL [31]) for the various cyber-attack scenarios and a comparison was performed using various representative performance indices which measure the prediction accuracy quantitatively and select the most appropriate algorithm.”
MethodAssessing Machine Learning Techniques for Intrusion Detection in Cyber-Physical Systems
dos Santos, V. F., Albuquerque, C. V. N., Passos, D. G., et al. (2023) · Energies · doi:10.3390/en16166058 · Cited by 16
A behavioral-based forensic investigation approach for analyzing attacks on water plants using GANs
Neshenko, N., Bou‐Harb, E., & Furht, B. (2021) · Forensic Science International Digital Investigation · doi:10.1016/j.fsidi.2021.301198 · Cited by 16
Reconstructing nodal pressures in water distribution systems with graph neural networksPreprint
Hajgató, G., Gyires-Tóth, B., & Paál, G. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.13619 · Cited by 16
GNN-based Advanced Feature Integration for ICS Anomaly Detection
Lu, S., Wang, K., Wei, Y., Liu, H., Fan, Q., & Wang, B. (2023) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3620676 · Cited by 15
“(4) BATADAL [31]: The BATADAL dataset is a creation of a battle of attack detection algorithms designed for discovering cyber attacks in water distribution systems.”
BackgroundZhou, W., Kong, X.-M., Li, K., Li, X., Ren, L., Yan, Y. G., Sha, Y. D., Cao, X., & Liu, X. (2021) · Computer Communications · doi:10.1016/j.comcom.2021.04.014 · Cited by 16
Housh, M., Kadosh, N., & Haddad, J. (2022) · Sensors · doi:10.3390/s22166035 · Cited by 16
Self-citationMoazeni, F. K., & Khazaei, J. (2021) · Sustainable Cities and Society · doi:10.1016/j.scs.2021.103370 · Cited by 14
Erba, A., Taormina, R., Galelli, S., Pogliani, M., Carminati, M., Zanero, S., & Tippenhauer, N. O. (2019) · arXiv (Cornell University) · Cited by 14
Self-citationDu, X., Zhou, C., Tian, Y.-C., & Wang, K. (2024) · IEEE Sensors Journal · doi:10.1109/jsen.2024.3384275 · Cited by 13
“Restrictions apply. also the publicly available attack detection dataset BATADALs [21].”
BackgroundAI for Cyberbiosecurity in Water Systems—A Survey
Sobien, D., Yardimci, M. O., Nguyen, M. B. T., Mao, W.-Y., Fordham, V., Rahman, A., Duncan, S. E., & Batarseh, F. A. (2023) · Springer eBooks · doi:10.1007/978-3-031-26034-6_13 · Cited by 16
Moazeni, F. K., & Khazaei, J. (2021) · Sustainable Cities and Society · doi:10.1016/j.scs.2021.102895 · Cited by 13
A Statistical Analysis Framework for ICS Process Datasets
Turrin, F., Erba, A., Tippenhauer, N. O., et al. (2020) · doi:10.1145/3411498.3419961 · Cited by 13
Self-citationKravchik, M., & Shabtai, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.01216 · Cited by 13
“The details of the calculation of both scores are based on the log record labels and are described in [42].”
BackgroundMethodInfluentialA hybrid dynamic graph neural network framework for real-time anomaly detection
Moraitis, G., & Makropoulos, C. (2024) · Journal of Hydroinformatics · doi:10.2166/hydro.2024.164 · Cited by 12
Normal-only Anomaly detection in environmental sensors in CPS: A comprehensive review
Acquaah, Y. T., & Roy, K. (2024) · IEEE Access · doi:10.1109/access.2024.3513714 · Cited by 13
Deployment Challenges of Industrial Intrusion Detection Systems
Wolsing, K., Wagner, E., Basels, F., Wagner, P., & Wehrle, K. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-82349-7_29 · Cited by 12
Using Datasets from Industrial Control Systems for Cyber Security Research and Education
Lin, Q., Verwer, S., Kooij, R. E., & Mathur, A. P. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-37670-3_10 · Cited by 12
A Machine Learning approach to Intrusion Detection in Water Distribution Systems – A Review
Mboweni, I. V., Abu-Mahfouz, A. M. I., & Ramotsoela, D. T. (2021) · Annual Conference of the IEEE Industrial Electronics Society (IECON) · doi:10.1109/iecon48115.2021.9589237 · Cited by 11
“Disclosing the nature of the anomaly is important (e.g., cyber-attack, malfunctioning actuator, etc) [22].”
BackgroundMethodInfluentialKaç, S. B., Zavrak, S., & Eken, S. (2022) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-01984-5_17 · Cited by 12
Maheshwari, A., Abokifa, A. A., Biswas, P., & Gudi, R. D. (2020) · Journal of Environmental Engineering · doi:10.1061/(asce)ee.1943-7870.0001738 · Cited by 12
Self-citationSeo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15
Metadata
- Authors
- Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., Ostfeld, A., Eliades, D. G., Aghashahi, M., Sundararajan, R., Pourahmadi, M., Banks, M. K., Brentan, B. M., Campbell, E., Lima, G., Manzi, D., Ayala-Cabrera, D., Herrera, M., Montalvo, I., Izquierdo, J., Luvizotto, E., Chandy, S. E., Rasekh, A., Barker, Z. A., Campbell, B., Shafiee, M. E., Giacomoni, M., Gatsis, N., Taha, A., Abokifa, A. A., Haddad, K., Lo, C. S., Biswas, P., Pasha, M. F. K., Kc, B., Somasundaram, S. L., Housh, M., & Ohar, Z.
- Affiliations
- Singapore University of Technology and Design (SG)
- Independent Water Resources Consultant, OptiWater, 6 Amikam Israel St., Haifa 3438561, Israel.
- Technion – Israel Institute of Technology (IL)
- University of Cyprus (CY)
- Texas A&M University (US)
- CRAN (FR)
- Berliner Wasserbetriebe (Germany) (DE)
- Universidade Estadual de Campinas (UNICAMP) (BR)
- Research Fellow, Dept. of Water, Irstea, BP 5095, 34196 Cestas, France.
- University of Bath (GB)
- Research Engineer, Ingeniousware GmbH, 76137 Karlsruhe, Germany.
- Universitat Politècnica de València (ES)
- Data Scientist, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
- Lead R&D Engineer, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
- Water Resources Engineer, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
- Chief Data Scientist, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
- The University of Texas at San Antonio (US)
- Washington University in St. Louis (US)
- California State University, Fresno (US)
- University of Haifa (IL)
- Corresponding author
- Galelli, Stefano
- ORCID
- Taormina, Riccardo
- Galelli, Stefano
- Tippenhauer, Nils Ole
- Salomons, Elad
- Ostfeld, Avi
- Eliades, Demetrios G.
- Sundararajan, Raanju
- Brentan, B. M.
- Campbell, Enrique
- Herrera, M.
- Montalvo, I.
- Izquierdo, J.
- Luvizotto, E.
- Rasekh, Amin
- Campbell, Bruce
- Shafiee, M. Ehsan
- Giacomoni, Marcio
- Gatsis, Nikolaos
- Taha, Ahmad
- Abokifa, Ahmed A.
- Lo, Cynthia S.
- Biswas, Pratim
- Pasha, M. Fayzul K.
- Kc, Bijay
- Housh, Mashor
- Venue
- Journal of Water Resources Planning and Management
- Published
- 2018-08
- Volume
- 144
- Issue
- 8
- ISSN
- 0733-9496 (ISSN-L)
- 1943-5452
- OpenAlex
- W2807219356
- Semantic Scholar
- 64815d88bf9bfb49e6e9e2bb9be6eac3d56ea7f6
- Cited by
- 277
- References
- 33
- Citations by year
- 2026: 49 · 2025: 45 · 2024: 38 · 2023: 31 · 2022: 29 · 2021: 36 · 2020: 25 · 2019: 19 · 2018: 5
- FWCI
- 13.14
- Type
- journal article
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Journal of Water Resources Planning and Management (publishedVersion)
- Pure (University of Bath) (submittedVersion, other-oa)
- RiuNet (Universitat Politècnica de València) (submittedVersion, cc-by-nc-nd)
- Cambridge University Engineering Department Publications Database (submittedVersion)
- Zenodo (CERN European Organization for Nuclear Research) (submittedVersion, cc-by)
- Greater South Information System
- Funders
- Washington University in St. Louis
- European Commission (739551, HORIZON2020)
- National Research Foundation (NRF2014NCR-NCR001-40)
- Fonds National de la Recherche Luxembourg
- Coordenação de Aperfeiçoamento de Pessoal de Nível Superior
- Conselho Nacional de Desenvolvimento Científico e Tecnológico
- Qatar National Research Fund (NPRP8-1292-2-548)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Engineering › Civil and Structural Engineering › Water Systems and Optimization
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- cyberattack detection, water distribution systems, cyber-physical attacks, SCADA, programmable logic controller, attack detection algorithm, algorithm comparison, detection time, classification accuracy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-21, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-21 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
