## 1 Introduction  
Most infrastructure systems (e.g., water distribution systems (WDSs), power grid systems, and telecommunication systems) have been monitoring and controlling their remote sensing data on supervisory control and data acquisition (SCADA) systems and programmable logic controllers (PLCs) to efficiently operate and manage. These supervisory and logical systems can be described as cyber-physical systems (CPSs) that are connected by the cyber network to physical devices. Because a CPS can monitor and control the physical processes of equipment in real-time, it is practical and convenient to make use of such systems in the operation of infrastructure systems, wherein even a minor malfunction can cause serious damage. In the past few years, the CPSs have been used in several infrastructure systems from power grid systems to telecommunications systems. They have also been used in water utilities, such as in WDSs,water supply reservoirs, and water treatment systems [1; 2; 3]. Although the utilization of CPSs in these infrastructure systems has proven to be efficient, they are vulnerable to cyber-physical attacks. The PLCs, actuators, and sensors that the CPSs make use of may be compromised by information disturbance to the sensor and communication server. Recently, major infrastructure systems (e.g., power grid, communication, and water networks) have been damaged by cyber-attacks; hence, prevention against cyber-attacks has been a focus in engineering fields, particularly for WDSs [3; 4; 5]. WDSs can directly affect public health and the environment. If the WDSs are damaged by cyber-attacks, there may be serious consequences, such as water shortages or degrading water quality [6]. Recently, WDSs technologies have been developed to use SCADA systems and advanced metering infrastructures (AMIs). These technologies are used to forecast the future state of the systems, such as the values of demand, pressure, and water quality, to detect abnormal conditions in the system (e.g., pipe breakage, leakage, and contamination events) [7; 8; 9; 10] and to determine the optimal operating conditions for pumps and valves [11; 12]. With these developments comes the increased risk of cyber-attacks on the WDSs. Therefore, emphasis must be placed not only on the development of WDSs using the latest technology, but also on the development of technology to minimize the damage brought about by cyber-attacks and detect such attacks in real-time situations.Previous studies conducted dealt primarily with cyber-attacks on power grid systems. Initially, the studies focused on the missing data collecting for the communication problems and the malfunction of measurement error between storage sources and sensors in SCADA systems [13; 14]. The focus of later studies shifted to the interactions between PLCs and actuators, such as scenarios wherein incorrect information is deliberately inputted, leading to system overload and malfunctions [15; 16; 17]. Recent studies performed real-time state estimations of cyber-attacks. Given the ability of modern technology to generate and store a large amount of data, real-time data forecasting is an efficient approach for optimal and reliable system operations. In the case of power grid systems, this process involves estimating unknown data based on the real-time measurements of system variables, such as flow and voltage values [15; 18; 19; 20; 21]. To detect false data cyber-attacks against the state of the systems, studies have undertaken a computationally efficient heuristic and Bayesian approach [20]. [PERSON] et al. [17] proposed a framework for identifying a set of power lines that could be overloaded due to false data inputs, and should be strictly monitored to ensure the reliability and safety of power systems. However, given the recent attacks and minute malfunctions in the system, models that more accurately detect such events are essential. In response to this, recent studies have applied machine learning approaches to the development of such models [22; 23; 24].