# Visualization Assisted Approach to Anomaly and Attack Detection in Water Treatment Systems
## 3 Visualization-Assisted Approach to Anomaly and Attack Detection  
The suggested approach to anomaly and attack detection in the water treatment system consists of the two key connected components:  
* Attack detection component based on supervised machine learning;
* Sensor data visualization component. The scheme of the proposed approach is presented in Figure 1.  
Figure 1: The scheme of the proposed visualization assisted anomaly and attack detection approach. The attack detection component consists of \(n\) binary classifiers that are trained to detect \(n\) different classes of the attacks, and one generalized multi-class classifier targeted to detect one of the \(n\) specific attacks. The current implementation of the component detects five different classes of the attacks but could be extended to detect novel ones. The following seven supervised machine learning methods were selected as possible candidates for detecting each class of attack and serving as basis for a generalized multi-class classifier: AdaBoostClassifier, RandomForestClassifier, Bayesian classifier, LogisticRegression, Linear SVM classifier, Decision Trees, and RidgeClassifier. A series of experiments on the test data sets made it possible to determine the most effective machine learning model as well as its parameters. The efficiency assessment was conducted using two quality metrics: accuracy and f1-score. Section 5 discusses the experiment settings as well their results in detail. The visualization component supports the visual exploration of the system parameters and monitoring of the system state. The distinctive feature of this component is the calculation and visualization of the metric that characterizes the number of changes in the system at the given moment of time. This metric was firstly introduced in [10] and considers a set of selected attributes that are used to evaluate how the system state changes over time. The calculation of the integral metric is presented in Section 3 in detail. To visualize the values of this metric, the line plot with time axis is used. The selected visualization model is simple but intuitively clear to the operator. It provides a natural perception of the situation and allows unambiguous identification of changes in the system that could correspond to the anomalies or attacks in the system behavior. Visualization-Driven Explanation and Analysis ComponentWhen designing the visualization of data streams from sensors, the authors kept in mind following challenges identified in [22]  
* Necessity to combine streaming data from diverse sources to support analysis;
* Support for understanding changes that could be expressed in many forms, starting from changes in parameters' values between previous and current ones and finishing with deviations in system behavior as a whole;
* Dynamic nature of data, which are constantly changing and evolving in time. In [19], the authors suggested representing a state of the system that is defined by a set of sensors as a point in a multidimensional space, and then the functioning of this system could be considered as a trajectory in this space. Such representation allows addressing the first challenge relating to the necessity to combine streaming data from multiple sources. Moreover, in [19], it was shown that mapping a system's trajectory in multidimensional space to the plane enables revealing system behavior patterns as well as anomalies. Different states of the system are characterized by different graphical patterns that vary in point density and scatter. In [23], the authors evaluated different metrics that could be used to assess the similarity of the points distribution on the plane in order to detect structural similarity, and they showed that Delaunay triangulation could be used to detect typical patterns as well as outliers when evaluating projections produced by data reduction techniques.