# Visualization Assisted Approach to Anomaly and Attack Detection in Water Treatment Systems
## 6 Conclusions  
The problem of the attack and anomaly detection in cyber-physical systems, such as water treatment systems, electric power stations, etc., is of great practical importance, as malicious activity may result in a significant impact on the environment and human safety. In the general case, attacks on sensors of a wireless sensor network are characterized by the complexity of identifying such attacks and their differences from various software and hardware/software failures. In addition, they are characterized by the complexity and potential ambiguity of interpreting the analyzed data and classifying them as traces of an attack without involving additional data from alternative protection mechanisms.  
The paper proposes a visualization-assisted approach to anomaly and attack detection in a water treatment system constructed on the basis of a wireless sensor network. The distinctive feature of the proposed approach is a combination of the machine learning and visualization techniques. The former refers to automated attack detection based on supervised learning on the labeled data sets with five attack classes and mixed data. The latter is used to assist in anomaly detection and its explanation and the monitoring of the system state. The authors propose visualizing a metric that characterizes the amount of change in the system state for a given period. As its calculation is based on a set of system parameters, it could be considered as an integral and be used in forming the situation awareness of the analyst.  
To evaluate the proposed approach, a water treatment test bed was developed. It includes a software/hardware prototype of the system that models water treatment processes both on physical equipment and microcircuits, as well as a software simulator that allows generating a sufficient amount of initial data of the normal functioning of the system and when the system is under attack. In particular, such simulation made it possible to model five classes of attacks on system sensors and combinations of several attacks. The obtained data sets were used to train and test classifiers that implement attack detection and evaluate the efficiency of the visualization component.  
The conducted experiments showed the high values of the detection quality metrics for the machine learning methods applied. It was also shown that the proposed visualization is able to reveal different anomalous scenarios and determine graphical patterns corresponding to them. It allows detecting points of interest that are considered as a starting point of the manual or machine-assisted \"root-cause\" analysis of the anomalies. However, the experiments also identified certain limitations in terms of the visualization. They relate to the parameters' fine-tuning procedure for calculation and visualization of the proposed metric. The enhancement of the metric calculation procedure and elaboration of the recommendations for its application is included in the scope of future works. Another direction of the future work relates to the enhancement of the test bed and extension of the modeled attack scenarios.  
Conceptualization, V.D., E.N. and I.K.; methodology, V.D. and E.N.; software, A.M. and A.S.; validation, A.M., A.S. and V.D.; visualization, A.S. and E.N.; supervision, I.K.; project administration, I.K. All authors have read and agreed to the published version of the manuscript.  
This research is being supported by the grant of RSF #22-21-00724 in SPC RAS.  
Not applicable.  
The data set is available upon the request to the corresponding authors.  
The authors declare no conflict of interest.