# Visualization Assisted Approach to Anomaly and Attack Detection in Water Treatment Systems
## 2 Related Works  
Currently, the security of the Internet of Things systems and wireless sensor networks has been the subject of a series of works. Some of them deal with aspects related to attacks on the routing protocol. For example, [PERSON] et al. suggested several ways to detect Sinkhole attacks, i.e., sophisticated routing effects [2]. In contrast to existing ones, the specificity of this article is that it concerns elements of attack detection by identifying correlationsbetween sensor readings without considering direct malicious actions on the network protocol level and/or other physical and software parts. The issues of ensuring and assessing the security of Internet of Things systems, robotic complexes and wireless sensor networks, including studies of the impact on device sensors, are becoming increasingly relevant [1]. By influencing the system by exploiting one or a few sensors, as the point of the application, the attacker is able to compromise a sensor and devices integrated with it or located near it. In addition, the attacker can interfere with the data transmitted, processed and stored on the network devices and the information services provided. An attack on a sensor can be an element of a complex influence that can lead to various short-term or fatal disruptions in the functioning of the entire system and cause its inoperability. One of the ways to increase the security of such systems is the timely detection of malicious influences and obtaining additional information on them, including the class and source of the attack. In most of the analyzed literature sources, the detection of attacks and anomalies in Internet of Things systems is performed using various intelligent data analysis methods [1; 3; 4]. At the same time, the extraction of specific features, the construction of feature spaces, and the appointment of certain learning models, for the most part, are determined by the specific formulation of the problem and its limitations. In particular, the availability or absence of satellite communications in the network determine the short-term loss of connection accompanying this type of connection, especially due to the continuous movement of satellites in the orbit and the possible movement of ground devices of the network [5]. Depending on the structure and composition of the system, such losses should be separated from targeted actions of the attacker, for example, ones aimed at noising the GPS channel. [PERSON] et al. [3] proposed a way to detect attacks on sensors in a wireless sensor network by introducing a virtual sensor and using a sensor's fault model to establish inconsistencies between the readings of this sensor and other ones to be considered as attacks. [PERSON] et al. analyzed data from sensors of intelligent vehicle models to detect anomalies by using deep learning methods [1]. It is based on quantitative measurements of the readings of eight physical sensors of the car model, and the difference in the values of the sensor readings from the expected values is estimated. In the study, six particular classes of attacks and normal data are used. Each of them represents an attack on one or two of the available sensors. The conducted experiments made it possible to compute the indicators of accuracy and correctness, as well as to determines the training methods that grant the best outcome. In [5], by using the example of unmanned ground vehicles, some attacks on sensors are detected in conditions of possible transient faults. To distinguish between attacks and transient faults, a static model of the faults (faulty model) is built for each sensor, including the interval of its allowable values and the maximum allowable frequency of its faults. The attacks are detected on the basis of these models by pairwise comparisons of the readings of various sensors. In the process of machine learning, the most appropriate fault model is selected from the available models.