Cyber-Attack Detection in Water Distribution Systems Based on Blind Sources Separation Technique

Abstract

Service quality and efficiency of urban systems have been dramatically boosted by various high technologies for real-time monitoring and remote control, and have also gained privileged space in water distribution. Monitored hydraulic and quality parameters are crucial data for developing planning, operation and security analyses in water networks, which makes them increasingly reliable. However, devices for monitoring and remote control also increase the possibilities for failure and cyber-attacks in the systems, which can severely impair the system operation and, in extreme cases, collapse the service. This paper proposes an automatic two-step methodology for cyber-attack detection in water distribution systems. The first step is based on signal-processing theory, and applies a fast Independent Component Analysis (fastICA) algorithm to hydraulic time series (e.g., pressure, flow, and tank level), which separates them into independent components. These components are then processed by a statistical control algorithm for automatic detection of abrupt changes, from which attacks may be disclosed. The methodology is applied to the case study provided by the Battle of Attack Detection Algorithms (BATADAL) and the results are compared with seven other approaches, showing excellent results, which makes this methodology a reliable early-warning cyber-attack detection approach.

A Time-Series Self-Supervised Learning Approach to Detection of Cyber-physical Attacks in Water Distribution Systems

“…Hence, combining both algorithms is paramount to providing high normalized accuracy and a reliable detection system. [26] 0.98 0.96 0.97 ANN [24] 0.95 0.95 0.94 PCA [23] 0.96 0.93 0.92 RNN [32] 0.98 0.85 0.89 Statistical analysis [25] 0.86 0.88 0.77 RForest [22] 0.78 0.42 0.53 QDA [6] 0.94 0.95 0.94 MD [6] 0.92 0.90 0.91 Ensemble [6] 0.92 0.89 0.91 LOF [6] 0.89 0.85 0.87 SOD [6] 0.88 0.83 0.86 Naive Bayes [6] 0.50 1 0.75 LDA [6] 0.69 0.65 0.67 Statistical analysis [29] 0.973 0.19 0.973 ANN and PCA [54] 0.953 0.984 0.966 5NN [30] 0.512 0.323 0.418 ANN [30] 0.708 0.759 0.749 SVM [30] 0.756 0.722 0.754 ELM [30] 0.841 0.941 0.591 Table 5. S ACC , TTD, and S in stage 2 of using 6 h granularity.…”

“…These algorithms are Quadratic Discriminant Analysis (QDA), Mahalanobis Distance (MD), Local Outlier Factor (LOF), Subspace Outlier Degree (SOD), Naive Bayes (NB), Once-Class Support Vector Machine (OSVM), Linear Discriminant Analysis (LDA) and Ensemble model of parametric & Non-parametric algorithms. Brentan et al in [29] also utilized a two-step framework of attack detection in which fast Independent Component Analysis (fastICA) algorithm is applied followed by a statistical control algorithm. Moreover, Young et al [30] constructed an attack detection model on the same dataset using 5NN, ANN, and an extreme learning machine.…”

Flood Risks of Cyber‐Physical Attacks in a Smart Storm Water System

“…In parallel, the use of anomaly detection algorithms can differentiate false data from ordinary sensor noise. Several techniques ranging from fast Independent Component Analysis (Brentan et al., 2021), support vector machines (Nader et al., 2016), hidden Markov chains (Zohrevand et al., 2016), to information theory (Ahmed et al., 2016) have been introduced for this task. The realm of data‐driven anomaly detection remains a fertile ground for further research (Moazeni & Khazaei, 2022).…”

Algorithm Design for Resilient Cyber-Physical Systems using an Automated Attack Generative Model

“…In this section, a generative model is developed for generating successful FDI attacks targeting the model in (3). Including attack signals in the CPS model in (3) yields the adversarial measurement model…”

“…In 2015, 25 cyber attacks were disclosed in several water systems [2]. And recently in 2020, a malicious cyber-attack attempted to raise the chlorine level in Israel's water supply to dangerous proportion [3]. Supervisory Control and Data Acquisition (SCADA) is a critical part of the CPCI that is highly susceptible to cyberattacks.…”