Unsupervised cyber-physical intrusion detection and localization in water distribution systems via multivariate fusion of process, supervisory, and communication data

This study proposes a novel unsupervised cyber attack detection framework for water distribution networks that fuses data from process, supervisory, and communication layer attributes into a unified multivariate representation of system behavior for early and reliable attack detection. Within this framework, a temporal convolutional network autoencoder is trained exclusively on normal-operation data to learn expected system behavior, and its reconstruction residuals are monitored using a multivariate cumulative sum (MCUSUM) statistical process control chart for continuous attack detection. Upon anomaly detection, a correlation-maximization (corr-max) mechanism decomposes the MCUSUM statistic to pinpoint the features and components that contribute most to the deviation and to support attack localization within the network. When evaluated on the BATtle of the Attack Detection ALgorithms (BATADAL) version 2.0 dataset, the proposed framework detected 23 of 25 attacks with no false alarms, achieved an average detection delay of 14 min, and accurately identified compromised components across all three layers of communication, process, and supervisory. The results demonstrate that the proposed method, through its integration of process, supervisory, and communication features, enables fast, reliable, and interpretable intrusion detection in cyber-physical water distribution systems, and consequently strengthens the cybersecurity resilience of modern water utilities against sophisticated cyber-physical attacks.