On-Line Cyber Attack Detection in Water Networks through State Forecasting and Control by Pattern Recognition

Water distribution systems are critical infrastructures that can be the subject of various types of attacks. Concerns range from biological and chemical intrusions in pipelines to operational issues in water control assets. Cyber-attacks have also turned today into a crucial issue to consider. In highly automatized infrastructures, cyber-attacks can be considered as non-planned actions changing system operation to non-expected scenarios. They can potentially produce unavailability of enough water appropriated for public consumption or critical services such as firefighting. This work proposes to tackle the identification of cyber-attack scenarios through an early-alarm system able to recognize patterns corresponding to abnormal working conditions of the system. Firstly, an on-line forecasting model is developed that is based on the water system expected state regarding nodal pressures, tank water levels and control device flows. Then, an approach based on non-linear autoregressive networks with exogenous inputs (NARX) is proposed to take advantage of both their computational efficiency and the strong influence of the periodicity of the inputs under study. Finally, an analysis of abrupt change point, conducted in a time series composed by the differences between the observed measurements and the expected data, is built on top of the forecasting model.