Detection of Cyber Physical Attacks on Water Distribution Systems via Principal Component Analysis and Artificial Neural Networks
Abstract
Automated monitoring and operation of modern water distribution systems (WDSs) are largely dependent on an interconnected network of computers, sensors, and actuators that are jointly coordinated by a supervisory control and data acquisition (SCADA) system. Although the implementation of such embedded systems enhances the reliability of the WDS, it also exposes it to cyber-physical attacks that can disrupt the system’s operation or compromise critical information. Hence, the development of attack detection algorithms that can efficiently diagnose and identify such assaults is crucial for the successful application of these automated systems. In this study, we developed an algorithm to identify anomalous behaviors of the different components of a WDS in the context of the Battle of the Attack Detection Algorithms (BATADAL). The algorithm relies on using multiple layers of anomaly detection techniques to identify both local anomalies that affect each sensor individually, as well as global anomalies that simultaneously affect more than one sensor at the same time. The first layer targets finding statistical outliers in the data using simple outlier detection techniques. The second layer employs a trained artificial neural networks (ANNs) model to detect contextual anomalies that does not conform to the normal operational behavior of the system. The third layer uses principal component analysis (PCA) to decompose the high-dimensional space occupied by the given set of sensor measurements into two sub-spaces representing normal and anomalous network operating conditions. By continuously tracking the projections of the data instances on the anomalous conditions subspace, the algorithm identifies the outliers based on their influence on the directions of the principal components. The proposed approach successfully predicted all of the pre-labeled attacks in the validation data set with high sensitivity and specificity. However, for all the detected attacks, the algorithm maintained a false “under attack” status for a few hours after the threat no longer existed.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The algorithm of Abokifa et al. (2017) comes a close second, with S equal to 0.949.
“The algorithm ofAbokifa et al. (2017) comes a close second, with S equal to 0.949.”
From Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks (2018) · cites this paper as Abokifa et al. (2017)
Cyber-physical attacks can tamper with one or multiple network components while keeping the performance characteristics within historical bounds.
“cyber-physical attacks can tamper one or multiple network components while keeping the performance characteristics within the historical bounds (Abokifa et al. 2017).”
From Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks (2018) · cites this paper as Abokifa et al. 2017
Abokifa et al. (2017) algorithm disclosed Attack #10 and #11 as a single continuous episode, erroneously flagging the system as under attack for the period in between.
“As shown in Figure 4(b), Abokifa et al. (2017) algorithm disclosed Attack #10 and #11 as a single continuous episode, erroneously flagging the system as under attack for the period in between.”
From Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks (2018) · cites this paper as Abokifa et al. (2017)
Cites
Chandola, V., Banerjee, A., & Kumar, V. (2009) · ACM Computing Surveys · doi:10.1145/1541880.1541882 · Cited by 11,687 · see citing works
Hawkins, D. M. (1980) · doi:10.1007/978-94-015-3994-4 · Cited by 2,982 · see citing works
Maier, H. R., & Dandy, G. C. (2000) · Environmental Modelling & Software · doi:10.1016/s1364-8152(99)00007-9 · Cited by 2,384 · see citing works
Diagnosing network-wide traffic anomalies
Lakhina, A., Crovella, M., & Diot, C. (2004) · Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication · doi:10.1145/1015467.1015492 · Cited by 1,399 · see citing works
Diagnosing network-wide traffic anomalies
Lakhina, A., Crovella, M. E., & Diot, C. (2004) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1030194.1015492 · Cited by 420 · see citing works
Amin, S., Litrico, X., Sastry, S., & Bayen, A. M. (2012) · IEEE Transactions on Control Systems Technology · doi:10.1109/tcst.2012.2211873 · Cited by 350 · see citing works
Neural Network based Intrusion Detection System for critical infrastructures
Linda, O., Vollmer, T., & Manic, M. (2009) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn.2009.5178592 · Cited by 242 · see citing works
Anomaly Detection via Online Oversampling Principal Component Analysis
Lee, Y., Yeh, Y.-R., & Wang, Y.-C. F. (2013) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2012.99 · Cited by 225 · see citing works
In-Network PCA and Anomaly Detection
Huang, L., Nguyen, X., Garofalakis, M., Jordan, M. I., Joseph, A. D., & Taft, N. (2007) · The MIT Press eBooks · doi:10.7551/mitpress/7503.003.0082 · Cited by 201 · see citing works
On SCADA control system command and response injection and intrusion detection
Gao, W., Morris, T. H., Reaves, B., & Richey, D. (2010) · eCrime Researchers Summit (eCrime) · doi:10.1109/ecrime.2010.5706699 · Cited by 187 · see citing works
Characterizing Cyber-Physical Attacks on Water Distribution Systems
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., & Ostfeld, A. (2017) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000749 · Cited by 175 · see citing works
Smart Water Networks and Cyber Security
Rasekh, A., Hassanzadeh, A., Mulchandani, S., Modi, S., & Banks, M. K. (2016) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000646 · Cited by 87 · see citing works
Assessing the Effect of Cyber-Physical Attacks on Water Distribution Systems
Taormina, R., Galelli, S., Tippenhauer, N. O., Ostfeld, A., & Salomons, E. (2016) · World Environmental and Water Resources Congress (EWRI) · doi:10.1061/9780784479865.046 · Cited by 22 · see citing works
Simulation of Cyber-Physical Attacks on Water Distribution Systems with EPANET
Taormina, R., Stefano, G., Tippenhauer, N. O., Salomons, E., & Ostfeld, A. (2016) · IOS Press eBooks · doi:10.3233/978-1-61499-617-0-123 · Cited by 14 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., Ostfeld, A., Eliades, D. G., Aghashahi, M., Sundararajan, R., Pourahmadi, M., Banks, M. K., et al. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000969 · Cited by 277 · see citing works
Self-citationKravchik, M., & Shabtai, A. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3050101 · Cited by 224 · see citing works
A Systematic Review of the State of Cyber-Security in Water Systems
Tuptuk, N., Hazell, P., Watson, J., & Hailes, S. (2021) · Water · doi:10.3390/w13010081 · Cited by 138 · see citing works
Li, J., Li, H., Ma, Y., Wang, Y., Abokifa, A. A., Lu, C., & Biswas, P. (2017) · Building and Environment · doi:10.1016/j.buildenv.2017.11.001 · Cited by 106 · see citing works
Self-citationAbokifa, A. A., Haddad, K., Lo, C. S., & Biswas, P. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001023 · Cited by 84 · see citing works
Self-citationAttack detection in water distribution systems using machine learning
Ramotsoela, D. T., Hancke, G. P., & Abu-Mahfouz, A. M. I. (2019) · Human-centric Computing and Information Sciences · doi:10.1186/s13673-019-0175-8 · Cited by 82 · see citing works
A Survey of Cyber-Physical Attacks and Detection Methods in Smart Water Distribution Systems
Addeen, H. H., Xiao, Y., Li, J., & Guizani, M. (2021) · IEEE Access · doi:10.1109/access.2021.3095713 · Cited by 53 · see citing works
Cyber-Physical Systems for Water Supply Network Management: Basics, Challenges, and Roadmap
Adedeji, K. B., & Hamam, Y. (2020) · Sustainability · doi:10.3390/su12229555 · Cited by 41 · see citing works
Mahmoud, H., Wu, W., & Gaber, M. M. (2022) · Energies · doi:10.3390/en15030914 · Cited by 36 · see citing works
Aslam, M. M., Tufail, A., Kim, K., Apong, R. A. A. H. M., & Raza, M. T. (2023) · Sensors · doi:10.3390/s23187999 · Cited by 34 · see citing works
Reducing Vulnerability to Cyber-Physical Attacks in Water Distribution Networks
Nicolaou, N., Eliades, D. G., Panayiotou, C. G., & Polycarpou, M. M. (2018) · International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater) · doi:10.1109/cyswater.2018.00011 · Cited by 31 · see citing works
Fung, C., Srinarasi, S., Lucas, K., Phee, H. B., & Bauer, L. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17143-7_24 · Cited by 28 · see citing works
An improved autoencoder-based approach for anomaly detection in industrial control systems
Aslam, M. M., Tufail, A., Silva, L. C. D., Apong, R. A. A. H. M., & Namoun, A. (2024) · Systems Science & Control Engineering · doi:10.1080/21642583.2024.2334303 · Cited by 28 · see citing works
A CVAE-Based Anomaly Detection Algorithm for Cyber Physical Attacks for Water Distribution Systems
Addeen, H. H., Xiao, Y., & Li, T. (2024) · IEEE Access · doi:10.1109/access.2024.3384295 · Cited by 22 · see citing works
Detecting Cyber-Physical Attacks in Water Distribution Systems: One-Class Classifier Approach
Kadosh, N., Frid, A., & Housh, M. (2020) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0001259 · Cited by 19 · see citing works
Time Series Anomaly Detection with Variational Autoencoder Using Mahalanobis Distance
Gjorgiev, L., & Gievska, S. (2020) · Communications in computer and information science · doi:10.1007/978-3-030-62098-1_4 · Cited by 17 · see citing works
Anomaly Detection in Industrial Control Systems Based on Cross-Domain Representation Learning
Zhan, D., Zhang, W., Ye, L., Yu, X., Zhang, H., & He, Z. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3520155 · Cited by 13 · see citing works
AI for Cyberbiosecurity in Water Systems—A Survey
Sobien, D., Yardimci, M. O., Nguyen, M. B. T., Mao, W.-Y., Fordham, V., Rahman, A., Duncan, S. E., & Batarseh, F. A. (2023) · Springer eBooks · doi:10.1007/978-3-031-26034-6_13 · Cited by 13 · see citing works
Kravchik, M., & Shabtai, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.01216 · Cited by 13 · see citing works
Kaç, S. B., Zavrak, S., & Eken, S. (2022) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-01984-5_17 · Cited by 12 · see citing works
Decision Support System for Cyber Attack Diagnosis in Smart Water Networks
Quiñones-Grueiro, M., Prieto-Moreno, A., Verde, C., & Llanes‐Santiago, O. (2019) · IFAC-PapersOnLine · doi:10.1016/j.ifacol.2019.01.024 · Cited by 10 · see citing works
Enhanced Anomaly Detection for Cyber-Attack Detection in Smart Water Distribution Systems
Stojanović, B., Neuschmied, H., Winter, M., & Kleb, U. (2022) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3538969.3543796 · Cited by 10 · see citing works
Somma, M., Flatscher, A., & Stojanović, B. (2024) · Telecommunications Forum (TELFOR) · doi:10.1109/telfor63250.2024.10819044 · Cited by 8 · see citing works
Systematic and Efficient Anomaly Detection Framework using Machine Learning on Public ICS Datasets
Baptiste, M., Julien, F., & Franck, S. (2021) · 2021 IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr51186.2021.9527911 · Cited by 8 · see citing works
Rodríguez-Martínez, C., Quiñones-Grueiro, M., & Llanes‐Santiago, O. (2023) · Journal of Water Resources Planning and Management · doi:10.1061/jwrmd5.wreng-5302 · Cited by 6 · see citing works
Bross, L., & Krause, S. (2021) · Systems · doi:10.3390/systems9010002 · Cited by 6 · see citing works
González-Granadillo, G., Díaz, R., Caubet, J., & Vidal, I. G.-M. (2021) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp1020020 · Cited by 5 · see citing works
Malits, R., & Mendelson, A. (2025) · Water · doi:10.3390/w17030321 · Cited by 4 · see citing works
Chandran, P. S., & Sunil, K. S. (2025) · Journal of Water Process Engineering · doi:10.1016/j.jwpe.2025.108131 · Cited by 4 · see citing works
Vialatoux, C. F. , & Parrend, P. (2024) · Procedia Computer Science · doi:10.1016/j.procs.2024.09.690 · Cited by 4 · see citing works
Fayzul, M. M., & Pasha, K. (2018) · World Environmental and Water Resources Congress (EWRI) · doi:10.1061/9780784481424.043 · Cited by 3 · see citing works
Abokifa, A. A., & Biswas, P. (2018) · World Environmental and Water Resources Congress (EWRI) · doi:10.1061/9780784481424.040 · Cited by 3 · see citing works
Self-citationRemOD: Operational Drift-Adaptive Intrusion Detection
Maurya, V., Rani, N., & Shukla, S. K. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22829-2_17 · Cited by 2 · see citing works
Olortegui-Artica, C., Martínez-Solano, F. J., Briones, C. S., & Iglesias‐Rey, P. L. (2024) · Ingeniería del agua · doi:10.4995/ia.2024.20908 · Cited by 2 · see citing works
Advanced Detection of Cyber-Physical Attacks in Manufacturing Using LSTM-KNN
Penchalaiah, N., Kumar, A., Chaithrashree., A., Saivaraju, A., Bhoopathy, V., & Lamba, A. K. (2024) · International Conference on Data Science and Network Security (ICDSNS) · doi:10.1109/icdsns62112.2024.10690961 · Cited by 3 · see citing works
CBAT-ASG: Adversarial Sample Generation Method Based on CBA-Transformer
Xu, L., Yao, Z., Li, H., Diao, C., Zhou, G., Zhao, D., & Ding, H. (2025) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd64889.2025.11033503 · Cited by 1 · see citing works
Somma, M. (2025) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm67658.2025.11297553 · Cited by 1 · see citing works
Min, K. W., Choi, Y. H., & Kim, J. H. (2019) · Proceedings of the IAHR World Congress · doi:10.3850/38wc092019-1795
Min, K. W., Choi, Y. H., & Kim, J. H. (2020) · Korean Society of Hazard Mitigation · doi:10.9798/kosham.2020.20.5.47
Análisis de componentes principales (ACP), una aproximación basada en proyectos
Zaballa, D. A. D., & Carriegos, M. V. (2021) · Colección Jornadas y congresos · doi:10.18239/jornadas_2021.34.65
Physics-Augmented Autoencoder-Based Cyber-Attack Detection for Critical Water Infrastructure
Petrovic, K., Stojanovic, B., & Saukh, O. (2025) · International Conference on the Internet of Things (IoT) · doi:10.1145/3770501.3770507
Timed automata learning from time series
Cornanguer, L. (2023) · doi:10.70675/2921b612z4885z4ca2za9adz5337eb033d46
- Authors
- Abokifa, A. A., Haddad, K., Lo, C. S., & Biswas, P.
- Affiliations
- Washington University in St. Louis (US)
- Venue
- World Environmental and Water Resources Congress 2017
- Publisher
- American Society of Civil Engineers
- Published
- 2017-05-18
- Pages
- 676-691
- OpenAlex
- W2615438928
- Cited by
- 42
- References
- 14
- Citations by year
- 2025: 5 · 2024: 7 · 2023: 4 · 2022: 5 · 2021: 7 · 2020: 4 · 2019: 4 · 2018: 5 · 2017: 1
- FWCI
- 11.60
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- World Environmental and Water Resources Congress (EWRI) (publishedVersion)
- Topics
- Physical Sciences › Engineering › Civil and Structural Engineering › Water Systems and Optimization
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- cyber-physical attacks, water distribution systems, attack detection, SCADA, anomaly detection, outlier detection, contextual anomalies, principal component analysis, artificial neural networks, sensor measurements, false alarm reduction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
