Deep H2O: Cyber attacks detection in water distribution systems using deep learning

Abstract

Water Distribution Systems (WDSs) leverage the recent technological advancements in sensor technologies and Cyber-Physical Systems (CPSs) for better processing, distribution, and delivery of clean water. Given the digital nature of CPSs, they can be vulnerable to different kinds of cyber threats, especially in cases where adversaries can conceal the state of the attack. If an adversary (state or non-state actor) successfully compromises a WDS, that could result in major destructive consequences to water quality, public health, and agricultural irrigation. This paper presents empirical Artificial Intelligence (AI)-based methods for detecting such concealed attacks in WDS. We present two Deep Learning (DL) models: Temporal Graph Convolutional Network (TGCN) with Attention, a supervised learning model, and High Confidence Auto-Encoder (HCAE), an unsupervised learning model. TGCN adopts Attention and Robust Mahalanobis Distance (RMD) metrics for robust and generalizable forecasting performance. HCAE uses customized hidden layers to improve classification performance compared to state-of-the-art approaches. Experiments are performed to evaluate the proposed models using the BATtle of the Attack Detection ALgorithms (BATADAL) dataset; founded on a Supervisory Control And Data Acquisition (SCADA) infrastructure. Additionally, we assess the performance of the two models against synthetically poisoned data generated from a Generative Adversarial Network (GAN). Both attack detection models show superior accuracy with attack detection, localization, and overall robustness against data poisoning. The results suggest that both the supervised and unsupervised models perform better attack detection with a ranking score of 0.845 and 0.933, respectively. Results also indicate that, among the two models, the unsupervised model performs better in detecting poisoned data (accuracy: 0.992) and has better generalizability. Experimental results are recorded, evaluated, and discussed.