A Time‐Series Analytical Deep Learning Framework for Detecting Cyber‐Physical Attack in Water Distribution Systems

ABSTRACT The smart water distribution system is an essential and widely encompassing component of modern smart cities. While connecting to networks to improve infrastructure efficiency, it also exposes itself to the cyber environment, making it vulnerable to various cyber‐physical attacks, such as malicious manipulation of sensor data and unauthorized interference with communication between system components. These attacks could result in severe consequences. Moreover, attackers may employ network attack techniques, such as replay attacks, during the process of cyber‐physical attacks to disguise their malicious actions. This not only increases the harm caused by the attacks but also raises the difficulty of detecting such attacks. Numerous recent studies have tackled this issue using model‐based or data‐driven approaches to analyze attack characteristics. However, model‐based methods often rely on complex hydraulic models, while data‐driven approaches, although promising, still leave room for improvement in terms of detection accuracy and generalization ability. Additionally, both types of methods lack the capability to localize the affected components within the system, which is crucial for prompt response and mitigation of cyber‐physical attacks. This paper proposes a data‐driven time series analytical deep learning framework for detecting cyber‐physical attacks on water distribution systems, building a deep learning model based on an encoder‐decoder architecture and LSTM networks, and designing a reconstruction error calculation method specifically for time‐series data, which measures the discrepancy between the original and reconstructed sequences to detect potential attacks and localize the affected components. The framework was developed and tested on an open‐source dataset. Our method performed well in terms of accuracy, precision, recall, F1 score, and detection latency, thereby successfully detecting all attacks and localizing the affected components of the water distribution system while demonstrating stronger generalization capabilities and potential for further development.