Table 3 \(P_i\)(%) and \(\sum _{}^{}{P_j}, j \in \text {Top10} \left( \left\{ e_{ki} : k \in \mathscr {V}_i \right\} \right)\)(%) of each abnormal period on the WADI dataset. Attack identifier and attack description are from36. Note that we do not know the specific sensor (or sensor set) that causes the anomaly at each abnormal time point. We only give the \(P_i\) and \(\sum _{}^{}{P_j}\) of those sensors mentioned in the attack description.
From: Anomaly detection using spatial and temporal information in multivariate time series
Attack identifier | Attack description | Sensor i | \(P_i\) | \(\sum _{}^{}{P_j}\) |
|---|---|---|---|---|
1 | Motorized valve 1_MV_001 is maliciously turned on, this causes an overflow on the primary tank should reflect on 1_LT_001 and 1_FIT_001. | 1_MV_001 1_LT_001 1_FIT_001 | 0.000 0.232 0.364 | 0.642 0.066 0.046 |
2 | Flow Indication Transmitter 1_FIT_001 is turned off, and a false reading is seen by PLC for 1_FIT_001. This will turn the chemical dosing pump on while leaving the water level in the primary tank constant. Consequently, the attacker is increasing the level of chemicals inside the water. | 1_FIT_001 | 0.383 | 0.2 |
3-4 | Stealthy attack. The attacker aims to drain elevated reservoir 2_LT_002. This is done by controlling and manipulating tank level draining and filling speed. 1_AIT_001 Moreover the attacker changes the reading seen by the water quality sensor, which causes the raw water tank to drain. | 2_LT_002 1_AIT_001 | 0.000 0.154 | 0.051 0.000 |
5 | Turn off valves to consumers 2_MCV_101, 2_MCV_201, 2_MCV_301, 2_MCV_401, 2_MCV_501, 2_MCV_601 consumers will receive no more water. | 2_MCV_101 2_MCV_201 2_MCV_301 2_MCV_401 2_MCV_501 2_MCV_601 | 0.000 0.000 0.000 0.000 0.000 0.000 | 0.000 0.047 0.012 0.070 0.047 0.000 |
6 | Turn on maliciously 2_MCV_101, 2_MCV_201. | 2_MCV_101 2_MCV_201 | 0.000 0.000 | 0.000 0.000 |
7 | Supply contaminated water to the Elevated Reservoir tank by setting 1_AIT_002 to 6 to drain the primary grid because of contamination. at the same time open 2_MV_003. | 1_AIT_002 2_MV_003 | 0.472 0.000 | 0.000 0.029 |
8 | Maliciously open 2_MCV_007 in order to produce water leakage before the water reaches consumers. This attack should be reflected in 2_PIT_002 and 2_FIT_002. | 2_MCV_007 2_PIT_002 2_FIT_002 | 0.915 0.000 0.000 | 0.071 0.017 0.000 |
9 | Turn on 1_P_006 maliciously to cause a pipe burst. | 1_P_006 | 0.800 | 0.000 |
10 | Damage 1_MV_001 and raw water pump to drain Elevated Reservoir tank. | 1_MV_001 | 0.073 | 0.585 |
11 | Similar to attack 8. | 2_MCV_007 2_PIT_002 2_FT_002 | 0.927 0.000 0.000 | 0.044 0.015 0.000 |
12 | Similar to attack 8. | 2_MCV_007 2_PIT_00 2_FT_002 | 1.000 0.000 0.000 | 0.000 0.000 0.000 |
13 | Reducing Booster set point pressure causes intermittent water supply to consumers this should be reflected in 2_FIT_003 and 2_PIT_003. | 2_FIT_003 2_PIT_003 | 0.000 0.000 | 0.000 0.000 |
14 | Stop chemical dosing to the raw water which is supplied to the primary grid tank. | – | – | – |
15 | Stealthy attack, the inverse of attack 3. | 2_LT_002 1_AIT_001 | 0.016 0.000 | 0.036 0.062 |
