# Visualization Assisted Approach to Anomaly and Attack Detection in Water Treatment Systems
## 3 Visualization-Assisted Approach to Anomaly and Attack Detection
Anomalous bursts in the system's parameters result in larger values of the total square of the triangles obtained by Delaunay triangulation, while smaller values of the total triangles' square correspond to smoother changes in the system's behavior. The latter enabled the authors to define a novel _Change_Measure_ metric that characterizes the amount of system change and use it as an integral metric to monitor the state of the system [10]. The integral \(Change\_Measure\) metric is a core metric of the developed visualization system, and its usage addresses the second challenge identified in [22], enabling an analysis of changes in the whole system as well as changes between previous and current parameters' values. The metric is calculated for some given moment of time \(t\) and considers \(n\) subsequent data points in multidimensional space. The algorithm for calculation \(Change\_Measure(t,n)\) metric is given in Algorithm 1. Input: \(n\)--size of sliding window for sampling a sequence of points,  
\(t\)--moment of time  
S--a set of \(m\)-dimensional data points ordered in time and equipped with timestamps  
Output: \(Change\_Measure(t,n)\)  
```
1:apply data reduction technique PCA to the normalized set \(S\)
2:form a subset \(S^{\prime}(t,n)\) by selecting \(n\) sequential points from the \(S\) set that precedes a point with timestamp \(t\)
3:construct a Delaunay triangulation \(DP(S^{\prime}(t,n))\) for a set \(S^{\prime}(t,n)\). 4:calculate \(Change\_Measure(t,n)\) as a total area of obtained triangles of \(DP(S^{\prime}(t,n))\). 5:return\(Change\_Measure(t,n)\)
```  
**Algorithm 1** Integral \(Change\_Measure(t,n)\) metric calculation  
Currently, to reduce the data dimension, PCA is chosen as it allows revealing the deviations in a systems' behavior more clearly than other techniques [23]. The size of sliding window \(n\) is a customizable parameter and could be changed to enable better anomaly detection. Varying the window size, it is possible to control the impact of previous values on the current one. The values of the \(Change\_Measure(t,n)\) form a one-dimensional time series, and for this reason, it is natural to use the timeline to visualize it. To correlate system behavior with the results of the ML-based attack detection component and to highlight the periods when the system is under attack, the authors use a background color for the plot. The white background corresponds to the normal mode of system functioning, while the color background indicates that the ML-based attack detection component has detected an attack. In order to enhance the detection of visual signs of an anomaly in the system operation, the authors also propose performing post-processing of the obtained values of the \(Change\_Measure(t,n)\) metric. It is possible to apply sliding mean and median filters with a specified width of the filtering window. It should also be noted that the suggested visualization provides an overview of the system functioning, which is why it has to be supplemented by a set of timelines showing each parameter separately. Figure 2 shows the graphical interface of the visualization component, which consists of two main views: view A is used to represent values of the system parameters, and view B is used to visualize the integral metric \(Change\_Measure(t,n)\). These two views are synchronized, and the operator may select different time intervals to analyze and explore data. They could also choose different parameters to visualize and adjust the graphical properties of the plots. Similarly, the operator could adjust the calculation of the integral score metric by manipulating the sliding window size and applying different filters to smooth the values of \(Change\_Measure(t,n)\).