YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
Water Systems Attack Detection — CAIA 2022
📌 Project Overview
Water Systems Attack Detection — CAIA 2022 is a machine-learning project focused on detecting cyber-attacks and abnormal behavior in water distribution systems.
The project is based on work related to the Virginia Tech / CAIA 2022 research context, where machine-learning techniques are applied to identify malicious or abnormal activity within water-system operational data.
The main goal is to build a model capable of distinguishing between:
- 🟢 Normal system behavior
- 🔴 Attack / anomalous behavior
This type of system is part of Industrial Control System (ICS) security and Cyber-Physical System (CPS) security, where attacks against digital control systems can potentially affect physical infrastructure.
🎯 Project Objective
The primary objective of this project is:
Develop a machine-learning-based intrusion detection approach capable of identifying attacks targeting water distribution system operations.
The project aims to demonstrate how data-driven models can analyze sensor and system measurements and identify patterns that differ from normal operational behavior.
The overall concept can be summarized as:
Water System Data
│
▼
Data Preprocessing
│
▼
Feature Engineering
│
▼
Machine Learning Model
│
▼
Attack Detection
│
┌───┴────┐
▼ ▼
Normal Attack
🛡️ Why Water-System Security?
Modern water infrastructure increasingly relies on:
- Sensors
- Programmable Logic Controllers (PLCs)
- Supervisory Control and Data Acquisition (SCADA)
- Industrial communication networks
- Automated control systems
- Digital monitoring
This creates a connection between the physical water infrastructure and the cyber environment.
Consequently, an attacker who compromises a control or monitoring system could potentially manipulate system measurements or operational commands.
Machine learning can provide an additional security layer by learning the normal behavior of the system and detecting deviations.
🔬 Problem Definition
Traditional security mechanisms often rely on predefined signatures or rules.
However, industrial environments can experience:
Unknown Attacks
+
Changing System Behavior
+
Large Sensor Data
↓
Difficulty Detecting Anomalies
A machine-learning-based detector can instead learn patterns from historical system data.
The model attempts to learn:
Normal Behavior
↓
Expected Patterns
↓
Compare New Observation
↓
Deviation Detected?
│
┌──┴──┐
│ │
NO YES
│ │
Normal Attack
📊 Dataset
The project works with data representing the behavior of a water system under normal and attack conditions.
The data can contain measurements generated from different components of the water infrastructure, such as:
- Water-system sensors
- Process measurements
- System states
- Operational variables
- Control-related measurements
- Attack indicators / labels
The exact feature configuration depends on the specific dataset version used with the notebook.
🧹 Data Preprocessing
Before training the machine-learning model, the dataset is prepared for learning.
A typical preprocessing pipeline includes:
Raw Dataset
│
▼
Data Loading
│
▼
Missing / Invalid Values
│
▼
Feature Selection
│
▼
Data Cleaning
│
▼
Feature Scaling
│
▼
Train / Test Split
│
▼
Machine Learning
Numerical features may require normalization or standardization because different sensors can operate on significantly different scales.
🧠 Machine Learning Approach
The model treats attack detection as a supervised classification problem when attack labels are available.
The general formulation is:
X = System Measurements
y = System State / Attack Label
The classifier learns:
X → Model → y
where:
y = Normal
or:
y = Attack
Depending on the specific experiment, the classification problem may also contain multiple attack classes.
⚙️ Model Pipeline
The complete workflow can be represented as:
Water-System Dataset
│
▼
Data Preprocessing
│
▼
Feature Selection
│
▼
Normalization
│
▼
Train / Test
│
┌──────────┴──────────┐
│ │
▼ ▼
Training Testing
│ │
▼ ▼
Machine Learning Model Predictions
│ │
└──────────┬──────────┘
▼
Evaluation
│
┌──────────┴──────────┐
▼ ▼
Normal Attack
🚨 Attack Detection
The central task is identifying whether a particular observation represents normal system behavior or an attack.
Conceptually:
New Water-System Observation
│
▼
Feature Vector
│
▼
Trained Classifier
│
▼
Attack Probability
│
┌─────┴─────┐
▼ ▼
Normal Attack
This approach can help security systems detect suspicious behavior before it becomes a larger operational problem.
📈 Model Evaluation
The model should not be evaluated using accuracy alone.
For cybersecurity and attack detection, several metrics are important:
Accuracy
Measures the percentage of correctly classified samples.
Accuracy =
Correct Predictions / Total Predictions
Precision
Measures how many samples predicted as attacks were actually attacks.
Precision =
TP / (TP + FP)
Recall
Measures how many actual attacks were successfully detected.
Recall =
TP / (TP + FN)
F1-Score
Provides a balance between precision and recall.
F1 =
2 × Precision × Recall
-----------------------
Precision + Recall
Confusion Matrix
A confusion matrix provides a detailed view of classification performance:
Predicted
Normal Attack
┌────────┬────────┐
Actual Normal │ TN │ FP │
├────────┼────────┤
Actual Attack │ FN │ TP │
└────────┴────────┘
For an attack-detection system, false negatives are particularly important, because an undetected attack can represent a security risk.
🔍 Important Security Concepts
This project demonstrates several concepts at the intersection of:
Machine Learning
- Supervised learning
- Classification
- Feature engineering
- Data preprocessing
- Model evaluation
Cybersecurity
- Intrusion detection
- Anomaly detection
- Attack classification
- Industrial cybersecurity
- Cyber-Physical Systems
Critical Infrastructure
- Water-system monitoring
- Industrial control systems
- Sensor-based systems
- SCADA environments
🏭 Industrial Control System Context
The project can be viewed as an ICS intrusion-detection problem.
A simplified architecture is:
Physical Water System
│
▼
Sensors
│
▼
PLCs
│
▼
SCADA / Control Layer
│
▼
Network Traffic
│
▼
Security Monitoring
│
▼
Machine Learning Model
│
┌─────┴─────┐
▼ ▼
Normal Attack
The machine-learning component therefore acts as an additional monitoring layer around the industrial system.
🧪 Experimental Workflow
The project follows a typical machine-learning experimentation process:
1. Load the Dataset
Dataset
↓
DataFrame / NumPy
2. Explore the Data
Feature Distribution
+
Class Distribution
+
Missing Values
↓
Data Understanding
3. Prepare Features
Raw Features
↓
Cleaning
↓
Scaling
↓
Feature Matrix X
4. Prepare Labels
Attack / Normal
↓
Target y
5. Train the Model
X_train + y_train
↓
Machine Learning
↓
Trained Model
6. Test the Model
X_test
↓
Model
↓
Predictions
7. Evaluate
Predictions
↓
Accuracy
Precision
Recall
F1-Score
Confusion Matrix
📊 Class Distribution
Before training, class distribution should be inspected.
For example:
Dataset
│
├── Normal Samples
│
└── Attack Samples
If the classes are highly imbalanced, accuracy may provide a misleading evaluation.
Therefore, metrics such as precision, recall, F1-score, and confusion matrix become especially important.
🧠 Why Machine Learning?
Machine learning is useful in this context because system behavior can contain complex patterns that are difficult to represent using manually written rules.
Instead of explicitly defining:
IF sensor_A > X
AND sensor_B < Y
AND sensor_C = Z
THEN attack
the model can learn relationships from historical examples:
Historical System Data
│
▼
ML Training
│
▼
Learned System Patterns
│
▼
New System Observation
│
▼
Attack Detection
👨💻 My Contribution
This project was reviewed, modified, and adapted by Momen.
I worked on the implementation and experimentation to make the original approach more structured and suitable for practical machine-learning experimentation.
My modifications focus on areas such as:
- Organizing the notebook workflow
- Improving preprocessing
- Structuring the machine-learning pipeline
- Running model experiments
- Evaluating predictions
- Improving visualization and analysis
- Making the implementation easier to understand and reproduce
The project should therefore be considered an adapted and modified implementation, rather than a claim that the underlying research or dataset was originally created by me.
🛠️ Technologies
The project is primarily implemented using Python and common machine-learning tools.
Programming
- Python
Data Processing
- NumPy
- Pandas
Machine Learning
- Scikit-learn
- Machine-learning classification algorithms
Visualization
- Matplotlib
- Seaborn
Development Environment
- Jupyter Notebook
- Google Colab
📦 Installation
Clone the repository or download the notebook and install the required dependencies.
pip install numpy pandas matplotlib seaborn scikit-learn jupyter
Depending on the exact notebook implementation, additional libraries may be required.
🚀 Running the Project
1. Open the Notebook
jupyter notebook
or use Google Colab.
2. Load the Dataset
Place the water-system dataset in the expected dataset directory.
3. Run Preprocessing
Execute the preprocessing cells to:
- Load the data
- Clean the dataset
- Select features
- Prepare labels
- Split the data
4. Train the Model
Run the training cells to generate the trained classifier.
5. Evaluate
Evaluate the model using:
Accuracy
Precision
Recall
F1-Score
Confusion Matrix
6. Analyze Results
Inspect:
Predictions
+
Classification Metrics
+
Confusion Matrix
+
Visualizations
📁 Suggested Repository Structure
Water_Systems_Attack_Detection_CAIA_2022_Virginia_Tech/
│
├── README.md
│
├── notebooks/
│ └── water_system_attack_detection.ipynb
│
├── data/
│ └── README.md
│
├── models/
│ └── trained_models/
│
├── results/
│ ├── figures/
│ ├── predictions/
│ └── metrics/
│
├── requirements.txt
│
└── .gitignore
🔬 Research Perspective
The project demonstrates an important research direction:
Cybersecurity
+
Machine Learning
+
Critical Infrastructure
↓
Intelligent Attack Detection
Rather than treating cybersecurity and machine learning as separate disciplines, the project demonstrates how ML can be integrated into security monitoring for cyber-physical infrastructure.
🌐 Real-World Applications
The same general methodology can potentially be applied to other critical infrastructure environments, including:
- Water treatment systems
- Water distribution networks
- Power grids
- Manufacturing systems
- Industrial plants
- Oil and gas infrastructure
- Smart infrastructure
- SCADA environments
The model itself, however, should be validated separately for each environment because system behavior and attack characteristics can differ significantly.
⚠️ Limitations
Machine-learning-based attack detection has several limitations.
Dataset Dependency
A model can learn patterns specific to its training dataset and may not generalize perfectly to another water system.
Class Imbalance
Attack datasets may contain significantly fewer attack samples than normal samples.
False Positives
Normal operational changes can sometimes be incorrectly classified as attacks.
False Negatives
Some attacks may resemble legitimate system behavior and therefore remain undetected.
Dataset-to-Real-World Gap
Performance on a benchmark dataset does not automatically guarantee performance on a real operational water infrastructure environment.
🚀 Future Improvements
Potential improvements include:
- Compare multiple machine-learning algorithms
- Add Random Forest and Gradient Boosting
- Experiment with XGBoost
- Test neural-network-based classifiers
- Add anomaly-detection models
- Perform feature selection
- Address class imbalance
- Add cross-validation
- Tune model hyperparameters
- Add ROC-AUC and Precision-Recall curves
- Analyze false positives and false negatives
- Evaluate robustness against previously unseen attacks
- Investigate explainable AI techniques
- Compare supervised and unsupervised approaches
- Test temporal/deep-learning models such as LSTM
- Develop a real-time attack detection pipeline
📚 Learning Outcomes
Through this project, the following concepts are explored:
- Machine-learning classification
- Cybersecurity analytics
- Industrial Control System security
- Cyber-Physical Systems
- Water infrastructure security
- Data preprocessing
- Feature engineering
- Classification metrics
- Confusion matrices
- Attack detection
- Anomaly detection
- Critical infrastructure protection
- Machine-learning-based intrusion detection
🔑 Keywords
Water Systems
Water Distribution System
Attack Detection
Cybersecurity
Industrial Control Systems
ICS Security
SCADA
Cyber-Physical Systems
Machine Learning
Intrusion Detection
Anomaly Detection
Critical Infrastructure
Virginia Tech
CAIA 2022
Water Infrastructure Security
Machine Learning Security
Attack Classification
Python
Scikit-learn
Pandas
NumPy
📜 Disclaimer
This project is intended for educational, research, and cybersecurity experimentation purposes.
The attack-detection component is designed to study the identification of malicious or abnormal behavior in controlled datasets and should not be interpreted as a complete security solution for real-world water infrastructure.
📌 Project Summary
Water Systems Attack Detection — CAIA 2022 is a machine-learning cybersecurity project focused on detecting abnormal and malicious behavior in water-system data.
The project combines:
Water-System Data
↓
Data Preprocessing
↓
Feature Engineering
↓
Machine Learning
↓
Attack Detection
↓
Performance Evaluation
↓
Security Analysis
The work demonstrates how machine learning can be used as a security layer for critical water infrastructure, while also highlighting the challenges of dataset dependency, class imbalance, false positives, and generalization.
👨💻 Modified by Momen
Original research/dataset context: CAIA 2022 / Virginia Tech Implementation: Python + Machine Learning Adaptation & Modifications: Momen