## 4 Applications, Results, and Discussion
### Comparison of Prediction Results for the Various Standard Classification Approaches  
To determine the algorithm that exhibits the best detection performance, a comparison of the prediction results was conducted for the various original classification approaches dealing with WDS cyber-attack situations. Before the performance comparison, a sensitivity analysis of the parameters of each algorithm (e.g., training function, adaptation learning function, performance function, number of layers, number of neurons, and transfer function) was first performed by comparing the model performances depending on the parameter variation (see Table 5). To show the outperformed algorithm, this study performed a sensitivity analysis of the parameters of each algorithm. Based on the sensitivity analysis process, we found out appropriate parameters on each algorithm. Therefore, the performance comparison performed fairly. In the sensitivity analysis process, the parameters were changed within the range. The ANNs considered six parameters under each parameter's range (training functions: among 19; adaptation learning functions: among 5; transfer functions: among 3; number of layers: 1-10 (gap 1); number of neurons: 1-50 (gap 5); training probability: 40-80% (gap 10%)). \begin{table}
\begin{tabular}{c l} \hline \hline
**Algorithms** & **User Parameters** \\ \hline KNN & -Number of nearest neighbors = 5 \\ \hline \multirow{6}{*}{ANNs} & -Training function = Bayesian regularization back-propagation (TRAINBR) \\  & -Adaptation learning function = Bias learning function (LEARNGD) \\  & -Transfer function = Log-sigmoid (LOGISIG) \\  & -Number of layers = 3 \\  & -Number of neurons = 10 \\  & -70\% training, 15\% validation, and 15\% test datasets, respectively \\ \hline SVM & -Mathematical functions = Kernel Functions \\  & -Polynomial order = 3 \\ \hline ELM & -Activation function = Sine function \\  & -Number of hidden neurons = 52 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Selected parameters result for the parameter sensitivity analysis of applied machine learning algorithms. The SVM considered two parameters under each parameter's range (mathematical functions: among 4; polynomial order: 1-10% (gap 0.5)), while the ELM considered two parameters under each parameter's range (activation functions: among 5; number of hidden neurons: 10-150 (gap 1)). The Table 5 shows the results for the sensitivity analysis of the parameters of each algorithm. Table 6 represents the performance comparison results for the original versions of the learning algorithms. A visual detection comparison of the normal status and the under-attack conditions is illustrated in the bar charts given in Figure 3. The applied cyber-attack data comprise training/testing input and output data. The output data are configured as binary codes (i.e., normal condition and under-attack condition) based on the various hydraulic results of the system components (i.e., water level of tanks, status and water flow of pumps, status and water flow of valves, and pressure of junctions). It can be observed from Table 6 that an accuracy value according to the four variables (i.e., _TP_, _FP_, _TN_, and _FN_) can be used to evaluate the algorithms' total detection ability regardless of whether the condition is set as normal or under-attack. The detection accuracy values of all the applied algorithms were over 80%, which is quite high (see Table 6). However, the KNN exhibited a significantly lower _TPR_ than the other algorithms, only detecting cyber-attacks 10 times (_TP_). For the ANNs, most of the performance indices, except \(\mathsf{S}_{\mathsf{TID}}\), were of similar values or less than that of the SVM. Moreover, among the total events (normal conditions: 1682; under-attack conditions: 407), ANNs exhibited higher values of _FP_ and _FN_ than the SVM, amounting to 81 and 218, respectively. The ANNs exhibited a high false detection rate. However, the value of \(\mathsf{S}_{\mathsf{TID}}\) seen in the ANNs was 0.789, which was higher than that in SVM.