Cited by 279Smart Grid Security and ResilienceWater Systems and OptimizationNetwork Security and Intrusion Detection

The DOI matches its Crossref record; 36 of the 36 references it cites were found in a registry or an index; none of the 34 sources its claims cite is checked for support yet.

Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks

Open access

Abstract

The BATtle of the Attack Detection ALgorithms (BATADAL) is the most recent competition on planning and management of water networks undertaken within the Water Distribution Systems Analysis Symposium. The goal of the battle was to compare the performance of algorithms for the detection of cyber-physical attacks, whose frequency has increased in the last few years along with the adoption of smart water technologies. The design challenge was set for the C-Town network, a real-world, medium-sized water distribution system operated through programmable logic controllers and a supervisory control and data acquisition (SCADA) system. Participants were provided with data sets containing (simulated) SCADA observations, and challenged to design an attack detection algorithm. The effectiveness of all submitted algorithms was evaluated in terms of time-to-detection and classification accuracy. Seven teams participated in the battle and proposed a variety of successful approaches leveraging data analysis, model-based detection mechanisms, and rule checking. Results were presented at the Water Distribution Systems Analysis Symposium (World Environmental and Water Resources Congress) in Sacramento, California on May 21–25, 2017. This paper summarizes the BATADAL problem, proposed algorithms, results, and future research directions.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

BATADAL was a competition comparing seven attack-detection algorithms on simulated SCADA data from the C-Town water distribution network under cyber-physical attacks. The winning model-based approach by Housh and Ohar achieved the best overall ranking score (S = 0.970), while most algorithms outperformed naïve detection baselines.

Key findings

  • Seven teams participated; all but one achieved a ranking score S > 0.75, better than naïve detection mechanisms.
  • Housh and Ohar ranked first with S = 0.970, S_TTD = 0.965, S_CLF = 0.975, detecting all 7 test attacks; Abokifa et al. ranked second with S = 0.949.
  • The only model-based approach won: estimating water demands, simulating system dynamics with EPANET, and measuring errors against SCADA readings proved successful.
  • Aghashahi et al. ranked last with S = 0.534 and detected only 3 attacks; Chandy et al. was over-sensitive with many false alarms, while Pasha et al. lacked sensitivity.

Methods

  • Design challenge used the C-Town network: 429 pipes, 388 junctions, 7 storage tanks, 11 pumps, 5 valves, 1 reservoir, and 9 PLCs coordinated by SCADA.
  • Participants received three simulated SCADA datasets: Training dataset 1 with no attacks over 365 days at hourly time steps; Training dataset 2 with seven attacks over 492 hourly time steps; and a Test dataset with seven attacks over 407 hourly time steps.
  • Algorithms were evaluated by time-to-detection (S_TTD), classification performance (S_CLF = mean of TPR and TNR), and overall ranking score S = 0.5·S_TTD + 0.5·S_CLF.

Limitations

  • The paper states the evaluation was deterministic on three specific datasets representing only a small portion of possible cyber-attacks; robustness would require stochastic scenarios with varying hydraulic conditions and multiple attack sequences.
  • The paper states a major limitation is the absence of detailed real SCADA data on cyber attacks to water utilities, and that BATADAL relied on data generated with a demand-driven engine.
  • Evident from the text: participants were given the same computational model of C-Town used to generate the SCADA data, and demand patterns were fairly regular and consistent across datasets, which may limit real-world applicability.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1061/(asce)wr.1943-5452.0000969

Cites

36 of 36 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

22 No full text of the sources · 14 Own interpretation · 8 No basis given · 5 Sources not found · 4 Own method · 3 Own result · 2 Not checked yet

Show all 23 claims

  • It may state two separate claims as one. 20
  • Probably not a substantial claim. 20
35 of 35
  • The paper relies on this without support.

    All networked devices, including SCADA systems, represent potential targets.

    “Third, all networked devices, including SCADA systems, represent potential targets.”
  • The paper relies on this without support.

    It is not possible to rule out all attacks.

    “Since it is not possible to rule out all attacks, cyber-physical systems should also be equipped with intrusion detection schemes that assist with the recovery phase (Anderson 2010).”
  • The paper relies on this without support.

    The simulated SCADA data and attacks in the BATADAL datasets adequately represent real-world cyber-physical attacks on water distribution networks.

    “Participants were provided with datasets containing (simulated) SCADA observations, and challenged with the design of an attack detection algorithm.”
    “The datasets were generated via simulation with epanetCPA, a Matlab toolbox that allows to design a variety of cyber attacks and simulate, with EPANET2 (version 2.0.12), the hydraulic response of a water distribution network; see Taormina et al. (2017) for further details.”
3 of 3

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

1 of 1

Citations

Cites

Research works printed but not linked: 2

  1. Cardenas A. S. Amin B. Sinopoli A. Giani A. Perrig and S. Sastry. 2009. “Challenges for securing cyber physical systems.” In Vol. 5 of Proc. Workshop on Future Directions in Cyber-Physical Systems Security. Washington DC: Department of Homeland Security.
  2. Rossman L. A., 2000, EPANET 2 users manual

Cited by

Sorted by citations

See all 279

Metadata

Authors
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., Ostfeld, A., Eliades, D. G., Aghashahi, M., Sundararajan, R., Pourahmadi, M., Banks, M. K., Brentan, B. M., Campbell, E., Lima, G., Manzi, D., Ayala-Cabrera, D., Herrera, M., Montalvo, I., Izquierdo, J., Luvizotto, E., Chandy, S. E., Rasekh, A., Barker, Z. A., Campbell, B., Shafiee, M. E., Giacomoni, M., Gatsis, N., Taha, A., Abokifa, A. A., Haddad, K., Lo, C. S., Biswas, P., Pasha, M. F. K., Kc, B., Somasundaram, S. L., Housh, M., & Ohar, Z.
Affiliations
  • Singapore University of Technology and Design (SG)
  • Independent Water Resources Consultant, OptiWater, 6 Amikam Israel St., Haifa 3438561, Israel.
  • Technion – Israel Institute of Technology (IL)
  • University of Cyprus (CY)
  • Texas A&M University (US)
  • CRAN (FR)
  • Berliner Wasserbetriebe (Germany) (DE)
  • Universidade Estadual de Campinas (UNICAMP) (BR)
  • Research Fellow, Dept. of Water, Irstea, BP 5095, 34196 Cestas, France.
  • University of Bath (GB)
  • Research Engineer, Ingeniousware GmbH, 76137 Karlsruhe, Germany.
  • Universitat Politècnica de València (ES)
  • Data Scientist, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
  • Lead R&D Engineer, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
  • Water Resources Engineer, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
  • Chief Data Scientist, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
  • The University of Texas at San Antonio (US)
  • Washington University in St. Louis (US)
  • California State University, Fresno (US)
  • University of Haifa (IL)
Corresponding author
Galelli, Stefano
Venue
Journal of Water Resources Planning and Management
Published
2018-08
Volume
144
Issue
8
ISSN
  • 0733-9496 (ISSN-L)
  • 1943-5452
OpenAlex
W2807219356
Cited by
277
References
33
Citations by year
2026: 49 · 2025: 45 · 2024: 38 · 2023: 31 · 2022: 29 · 2021: 36 · 2020: 25 · 2019: 19 · 2018: 5
FWCI
13.14
Type
journal article
Language
en
Open access
Locations
  • Journal of Water Resources Planning and Management (publishedVersion)
  • Pure (University of Bath) (submittedVersion, other-oa)
  • RiuNet (Universitat Politècnica de València) (submittedVersion, cc-by-nc-nd)
  • Cambridge University Engineering Department Publications Database (submittedVersion)
  • Zenodo (CERN European Organization for Nuclear Research) (submittedVersion, cc-by)
  • Greater South Information System
Funders
  • Washington University in St. Louis
  • European Commission (739551, HORIZON2020)
  • National Research Foundation (NRF2014NCR-NCR001-40)
  • Fonds National de la Recherche Luxembourg
  • Coordenação de Aperfeiçoamento de Pessoal de Nível Superior
  • Conselho Nacional de Desenvolvimento Científico e Tecnológico
  • Qatar National Research Fund (NPRP8-1292-2-548)
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Engineering › Civil and Structural Engineering › Water Systems and Optimization
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Keywords
cyberattack detection, water distribution systems, cyber-physical attacks, SCADA, programmable logic controller, attack detection algorithm, algorithm comparison, detection time, classification accuracy

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-10-21, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-10-21 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review