## 5 Anomaly Detection in Water Systems
The FACIES testbed emulates the water system of the fictional HighLake City which primarily uses gravity to supply water to the different areas of the city as shown in Figure 3. The testbed consists of 5 tanks which represent different areas of the fictional city and a reservoir tank which serves as the main water source and sink. The reservoir supplies water to residential area 1 through tanks 1 and 2 using pumps. Residential area 1 supplies water to the industrial area (through tank 5) using a pump and also to residential area 2 (through tanks 3 and 4) using gravity. The configuration allows several different water distribution scenarios to be emulated and has many predefined fault mechanisms that can be used to test and evaluate algorithms in the application scenario. The authors in [61] used this testbed in their evaluation and found that FD is not an adequate mechanism to detect attacks because an attacker with sufficient knowledge of how the system operates would easily be able to shield their activities from detection. They however found that anomaly detection still works even when the attacker attempts to go unnoticed by launching stealthy attacks. The introduction of anomaly detection also makes it possible to distinguish between physical faults and attacks. It is thus evident that anomaly detection is a convenient second line of defence in critical water system applications. It is however necessary to discuss the applicability of these schemes taking two critical points into consideration. The first important consideration is that of prior knowledge, which in this and most other existing critical infrastructure applications is not a major issue when considering physical faults. Labelled training data is it pertains to system attacks is however not as  
Figure 3: FACIES Testbed. easily available making this a major limiting factor. The process dynamics of real world critical water infrastructure will evolve over time meaning that proposed anomaly detection schemes should take this into consideration [62]. The use of simulated data is useful in determining the viability of the proposed schemes but may not adequately portray the challenges of practically deployed full-scale system. This is especially true when considering the fact that anomalies are rare obscure events in practice which creates additional challenges as opposed to the simulated scenario where they are artificially created and clearly defined. An example of this can be seen in [63] where the authors used the real world Vitens Innovation Playground dataset which they found to lack sufficient logged information about anomalies. This lack of labelled training data severely hindered the scheme's performance because there was not enough information to enable them to adequately train the algorithm. It may not always be possible to obtain real world training data for full-scale systems especially in the case of system attacks which are even less frequent than system faults. It is however necessary for proposed schemes to be trained and tested against a variety of such attacks but as mentioned before simulated data may not always be adequate. This is where scaled down practical systems such as the FACIES testbed mentioned earlier could be useful. These scaled down versions of real world systems enable designers to work with system data as close to practically deployed systems as possible. The use of such systems could greatly improve accuracies because the full impact of modelled attacks can be observed and designers would be able to make informed decisions about aspects such as sensor placements and what the appropriate action should be taken when an anomaly is detected [64]. The latter is important because some anomalies could have devastating consequences if corrective action is not implemented in a timely manner, even just as an interim measure while the administrator investigates. The computational overhead of the detection schemes is also another limiting factor in terms of their applicability in practice.