Cyberattack Diagnosis in Water Distribution Networks Combining Data-Driven and Structural Analysis Methods

Most scientific contributions addressing cybersecurity issues in water distribution networks (WDNs) propose detection systems without considering the location problem. A methodology for detection and location of cyberattacks in WDNs is proposed in this paper. Structural analysis and neural networks are effectively combined with the control chart adaptive exponential weighted moving average (AEWMA). The proposed detection and location framework requires only data from normal operating conditions and knowledge about the behavioral model of the system. The validity of the methodology was demonstrated with the widely known case study Battle of the Attack Detection Algorithms (BATADAL). The detection method detected all the attacks with a false positive rate (false alarm rate) below 5% and true positive rate (TPR) (i.e., the detection rate) higher than 95%. The location method presents consistent diagnosis results while guaranteeing that the district metering area under attack always is identified.