# Visualization Assisted Approach to Anomaly and Attack Detection in Water Treatment Systems
###### Abstract  
The specificity of the water treatment field, associated with water transmission, distribution and accounting, as well as the need to use automation and intelligent tools for various information solutions and security tools, have resulted in the development of integrated approaches and practical solutions regarding various aspects of the functioning of such systems. The research problem lies in the insecurity of water treatment systems and their susceptibility to malicious influences from the side of potential intruders trying to compromise the functioning. To obtain initial data needed for assessing the states of a water treatment system, the authors have developed a case study presenting a combination of a physical model and a software simulator. The methodology proposed in the article includes combining methods of machine learning and visual data analysis to improve the detection of attacks and anomalies in water treatment systems. The selection of the methods and tuning of their modes and parameters made it possible to build a mechanism for efficient detection of attacks in data from sensors with accuracy values above 0.95 for each class of attack and mixed data. In addition, Change_Measure metric parameters were selected to ensure the detection of attacks and anomalies by using visual data analysis. The combined method allows identifying points when the functioning of the system changes, which could be used as a trigger to start resource-intensive procedures of manual and/or machine-assisted checking of the system state on the basis of the available machine learning models that involve processing big data arrays. anomaly detection; machine learning; water treatment; visual analytics 20221423420222022142342022214234202214234202214234202214234202142342022142342022142342022142342022142342022142342022142342022142342022142342022142342022142342021423420214234202142342021423420214234202142342021423 Generally, the work presents an approach for attack and anomaly detection that utilizes both machine learning and visualization techniques. Along with the classical machine learning analysis models, it is proposed to use a metric that characterizes the changes in the system for visual exploration of system parameters. This solution also supports validation of the constructed machine learning classifiers by means of the visual analysis and exploration of the system parameters as well as the system state to check the effectiveness of these analysis models. Such ongoing validation allows signaling the need to reconfigure the functioning classifiers due to the possible and expected natural evolution of the target system. The proposed detection mechanisms could be used in real-time and near-real-time modes, thus allowing the generation of alerts of security incidents with acceptable detection quality for a given time period. Thus, the _novelty_ of the proposed approach consists of the combination of the machine learning and visualization techniques that are used in conjunction to monitor both the system state and efficiency of the analysis models. The developed visualization serves as an express assessment of the system state. It could be made to obtain more detailed manual and/or machine-assisted assessments of the system. In addition, the applied visualization contributes to the reconfiguration and improvement of the machine learning classifiers, allowing one to take into account even relatively small changes in the behavior of the target system. Due to the limitations of the available equipment, a specific test bed for the water treatment system was developed. It was built on the principles of the full-scale and simulation modeling of the analyzed industrial process. The full-scale model was developed using Arduino microcontrollers, physical sensors and actuators, including sensors of water level, pressure and water flow, as well as electric valves and a water pump.