## 4 Results  
As part of CISS2021 preparation, several upgrades were carried out to SWaT. The chemical tanks were refilled, existing sensors re-calibrated, and additional components, e.g., valves and sensors, deployed. As these upgrades alter the characteristics of the data generated, the existing AICrit was retrained to avoid false positives. During this process, the representative models and explainable rules of AICrit discussed in [2], were fine-tuned using the data collected from SWaT by running them under various operating conditions. Table 9 summarizes the response of AICrit to the attacks launched during the CISS2021 event. We note that anomalies due to twenty-three out of twenty-seven attacks were detected soon after launch while those from the remaining four were not detected. Although the undetected anomalies were from attacks with the intention to alter the physical processes of SWaT, two out of four did not cause any process anomalies. Let us consider attack A1 in Table 2. In this attack, the adversary intended to stop the raw water filling process in tank T101 by closing the inlet valve MV101. Under normal circumstances, MV101 is opened only when level sensor LIT101 is below its preset low marker. However, as LIT101 is above the low marker, MV101 was already in a closed state and hence did not affect the physical process. Similar logic applies to attack A10 in Table 3. The adversary changed the control of MV101 to manual mode and attempted to close it when the level sensor LIT101 measurement dropped below 500 mm. However, due to water inflow from stage 6, the recycling process, to tank T101, LIT101 did not fall below 500 mm; hence, there were no process anomalies. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**ID** & **Type** & **Target(s)** & **Intention** & **Description** \\ \hline \multirow{4}{*}{A27} & \multirow{4}{*}{SSMP} & MV301, MV302, & \multirow{4}{*}{Redirect all water in} & 1. & Close the valves MV301 and MV302 \\  & & MV303, P301, P302 and & & 2. & Open the valve MV303 \\  & & LIT301 & T301 into UF drain & 3. & Turn OFF the pumps P301 and P302 \\  & & LIT301 & & 4. & Set LIT301 to 600 mm \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Attacks launched by red team 10. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Team ID** & **ID** & **AICrit Response** \\ \hline \multirow{4}{*}{RT1} & A1 & Not detected * \\ \cline{2-3}  & A2 & Abnormal change in FIT201 \\ \cline{2-3}  & A3 & \multicolumn{2}{c}{MV301 is closed but P602 is running} \\ \cline{2-3}  & & 1. & Abnormal change in LIT301 \\  & A4 & 2. & Both P301 and P302 are running \\ \cline{2-3}  & A5 & \multicolumn{2}{c}{Both MV502 and MV503 are open} \\ \cline{2-3}  & A6 & 1. & Both MV502 and MV503 are open \\  & A6 & 2. & Both P501 and P502 are running \\ \cline{2-3}  & A7 & 1. & Both P201 and P202 are running \\  & A8 & 1. & Abnormal change in LIT301 \\  & A9 & 1. & Both MV502 and MV503 are open \\  & A10 & 2. & Both P501 and P502 are running \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Performance comparison of AICrit and DAD. Anomalies due to attacks A14 and A18 were not detected by AICrit. In A18 the adversary set FIT101 to zero. Although this change was easy enough to detect, prior to the attack the adversaries brought down the historian. Hence, the detectors did not receive the plant state. Attack A14 was a Multi-Stage Multi-Point (MSMP) targeted pump P101 in stage 1 and valve MV201 in stage 2. Under normal SWaT operation, P101 is started only when LIT101 is above the low marker and LIT301 is below its high marker. Similarly, MV201 is opened if either P101 or P102 is running. Prior to the launch of A18, LIT101 and LIT301 were above the preset low marker, and P101 was not running; hence, MV201 was closed. Although pump P101 was started by the adversary before LIT301 dropped to below its low marker, this attack was not detected as no control rules were violated in AICrit and MV201 was turned ON.