# Visualization Assisted Approach to Anomaly and Attack Detection in Water Treatment Systems
## 4 Water Treatment Case Study
\begin{table}
\begin{tabular}{c c c} \hline \hline
**No** & **Data Field Name (Features)** & **Description** \\ \hline
1 & id\_record\_inc & - unique record identifier. It represents a field of Integer data type and is incremented by 1 when a new line is written to the output file. It is greater than zero always - readings of the upper water level sensor from the first tank. It represents a Boolean type variable. If this variable equals 0, the sensor does not work (the water level is below the sensor). If it is 1, the sensor works - readings of the middle water level sensor from the first tank. It represents a Boolean type variable - readings of the lower water level sensor from the first tank. - percentage of the first tank filling. It represents a field of data type Double. The readings correlate with Boolean water level sensors - status of the controlled crane. It is a Double type field and reflects the degree of tap opening from 0 (closed) to 1 (fully open) with a gradation of 0.1. For example, 0.5 indicates the tap is half open - measure of water flow between the tanks. It represents the Double data type and reflects the amount of water flowing through the sensor. It equals 0 if there is no water flow, and 1 when the tap is fully open and the maximum water flow between the tanks. It has a delta of one thousandth (0.001) - readings of the upper water level sensor from the second tank. It works similarly to the one from the first tank - readings of the middle water level sensor from the second tank (similarly to the one from the first tank) - readings of the lower water level sensor from the second tank (similarly to the one from the first tank) - status of the controlled crane (similarly to the one from the first tank) the first tank) - indicates the pump’s status. It is Boolean and equals 0 if the pump is not running and 1 otherwise - flow rate of water transferred through the pump between two tanks. It is Double and presents readings similarly to the first water flow sensor between the tanks - time in seconds from the start of the system. It is the Float data type. With each new entry it increases by 0.5 s - indicates the presence of an attack (for each sample). It is Boolean type. If there is an attack, it is 1; otherwise, it is 0 - exposes the specific class of attack, if any. The data type is Integer. It can take values from 0 to a specific number of attack classes. In the absence of an attack, it is 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Fields of the generated data sets. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Attack Class** & **Attack Name** & **Description** \\ \hline
1 & Attack on water level sensors & - the attack consists in modifying the readings of binary water level sensors. That is, during the attack, their readings do not match the readings of the tank fullness sensors. The attack is relevant for two tanks, and within the data set, this attack is marked by the classAttack label equal to 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Attack classes and their description. In addition, one more class can be introduced, the absence of any attack. This class is marked by label 0.