# Visualization Assisted Approach to Anomaly and Attack Detection in Water Treatment Systems
## 4 Water Treatment Case Study  
A case study modeling water treatment with the use of some available physical and electronic components was constructed. In addition, we developed a software tool expanding its business logic and simulating the system processes. This combined scheme allowed us to measure sensor readings directly and multiply and scale them by means of the simulator [24]. The scheme of the case study used in the work is exposed in Figure 3. The system contains two tanks. One tank is higher than the other (the top one is labeled as the first one and the bottom one as the second tank). Due to the influence of gravity, the water starts flowing from the first tank into the second one. The gate of the water treatment system imitates a controlled tap (electric crane) installed between the tanks. The tap closes when the second tank is full, and then the pump turns on and pumps the water back into the first tank. It simulates the process of lowering the water level on one side of the crane and rising on the other. To measure the water level in the tanks, water level sensors are installed. Each tank has three water level sensors and one sensor measuring the fullness degree. To measure the amount of water pumped between the tanks, in addition to the tap, a water flow sensor is installed. The hardware of the prototype is expressed by an Arduino UNO controller designed to read sensor readings and Raspberry PI for processing them and organizing functions to monitor the system's status. The software part  
Figure 2: The GUI of the visualization component: (**A**)—a view for displaying system parameters that are selected by an operator; (**B**)—a plot of the integral metric \(Change\_Measure(t,n)\), the background color shows the periods when the system was under the attack. includes a Web server built using the Python programming language, Django framework and ngnix libraries. This server is used to monitor the readings of sensors and states of the system actuators by a human operator. It should be noted that the developed prototype is a physically closed system. This is intended to facilitate its continued automatic operation in laboratory conditions and model target water treatment and dam systems closer to their reality. The tanks model water bodies on either side of the gate (shutter). When the gate is opened, the water level decreases on one side and increases on the other (water flow from tank 1 to tank 2). When the valve is closed, the water level decreases on one side (water goes further downstream), and on the other side, it increases (pumping from tank 2 back to 1). The pump was introduced in the model mainly to provide long enough working scenarios of the system. The developed simulator allowed us to generate a large number of possible states, which made it possible to speed up the modeling and testing of a variety of attacks, i.e., it is able to simulate attacks of several classes and form sets of various particular system states. For example, if it is necessary to generate a data set containing several hours of system operation, it is necessary to run the system model for the required time and constantly simulate attacks, and when simulating, this process is automated and takes less time. The constructed simulator works as follows: the initial state of the sensors and actuators of the system is set, then the actions occurring in the system are simulated by changing the readings of some sensors over a certain time (for example, half a second), and the related readings of other ones are adjusted. The simulator based on a short recording of sensor readings makes it possible to introduce small deviations into it, concatenating and mixing with other data, to generate longer logs at the output that simulate the operation of the system, thereby increasing the amount of data suitable for experiments. The formation of mixed data, including data of normal behavior and data about an attack of a certain class, is performed by modeling attack data and superimposing it on records of the normal functioning of the system.