# Visualization Assisted Approach to Anomaly and Attack Detection in Water Treatment Systems
## 5 Experiments and Discussion
### Analysis of the Proposed Visualization Efficiency
When the authors mapped the time intervals of the attack with this plot, it became clear that these spikes indicate the start and stop points of the attack. These spikes are clearly visible even when no sliding filters are applied. Thus, it could be concluded that the patterns of system behavior in the normal state and under a given attack do not differ, which indicates that in this case, the proposed method determines only the fact of anomaly appearance, but not its effect on the nature of system operation. Figure 8: Plot of the _Change_Measure_ metric constructed for different settings of the sliding filter: no filter is applied (**a**), sliding average filter with the window set to 30 is applied (**b**), sliding median filter with the window set to 30 is applied (**c**). The anomalies of the third and fifth types can be clearly seen on the linear plots without filtering (Figure 10a) and with sliding median filtering with a window set to 60 (Figure 10b). A characteristic feature of these attacks is a significant change in the density of points on the plane that results in the higher values of the _Change_Measure_ on the plot as well as in the absence of periods with a small change in the system state (Figure 10a). This makes median filtering more effective, enabling highlighting such periods more obviously. As in the previous case with an attack of the second class, there are also bursts at the beginning of the graph, which indicates the transient state of the system when it is reaching the normal operating mode. Such moments should be taken into account when applying this method. Figure 9: System parameters and _Change_Measure_ metric when the system is under attack of the second class: the plot of _Change_Measure_ metric with background color highlighting the periods with attacks (**a**), the plots of system parameters that characterize the volume of the water in the reservoirs (**b**). The anomaly of the fifth type turned out to be more difficult to determine visually, although it is a combination of attacks of classes three and four. In contrast to the previous cases, during this attack, the state of the system does not change significantly in comparison with the normal operation of the system, and periods with an anomalous operation, on the contrary, are characterized by lower values of the _Change_Measure_. Thus, the anomaly pattern for this attack consists in the smaller range of the metrics' values. The implemented visualization-driven approach to anomaly detection was also applied to the data set that contains all types of anomalies. Figure 11 shows the results obtained. The upper plot in Figure 11 shows the class of the attack if the system is under attack or zero if there is no anomaly in the system. The lower plot is the plot of the _Change_Measure_ metric. The anomalies of the first, third and fourth types are clearly seen, and these anomalies are highlighted by a background color in Figure 11. The visual detection of the anomalies of the second and fifth types is much more complicated. Thus, it is required to apply filtering with a sliding average filter with a window of 60 to reveal the attack of the second class, while the attack of the fifth class was still difficult to determine visually. The possible reason for this failure could be in the artificial origin of the data: the periods with anomalies successively replace each other, and there are almost no periods with normal functioning of the system except for the first one, but it corresponds to the transition period of the system when it reaches the normal operational mode. Figure 10: Plot of the _Change_Measure_ metric constructed for the system under attack of the third class: no filter is applied (**a**), sliding median filter with the window set to 60 is applied (**b**).