Two evaluations, each labelled for what it is. Neither is a customer site. Commissioning results are measured per site, on that site, against success criteria agreed before the appliance is connected.
Public academic water-treatment testbed (iTrust, SUTD). Labelled attacks against a live physical process.
Repository-generated Modbus/TCP traffic with synchronised simulated separator values. No customer data.
The Secure Water Treatment testbed at iTrust, Singapore University of Technology and Design. A six-stage physical water-treatment process with labelled attacks injected over several days.
It is public, physical and labelled, so anyone can rerun the evaluation and compare.
An academic testbed, not an operating plant. Attack types and process scale are those of the testbed.
Deterministic Modbus/TCP traffic generated from the repository, with synchronised simulated separator process values. Built to exercise the two evidence paths together.
It is reproducible byte for byte, carries category labels for every event, and contains no customer data.
Synthetic. It tests the mechanism, not a real process. Results are a technical reference, not a site claim.
The count of attack windows in the dataset for which at least one finding was raised inside the window. Shown as detected out of total.
Of all events flagged as attack, the share that were labelled attacks. High precision means few false alarms per true alarm.
The share of non-attack events flagged as attack, measured on data the model did not see during fitting.
An attack window counts as detected if any point inside it is flagged. The standard metric for time-series anomaly detection, and the one recorded in the SWaT metrics file.
The share of events placed in the correct category across attack, operational and other classes. Used in the two-channel evaluation, where every event carries a category label.
The minimum precision the evaluation must reach on holdout data for a release to be accepted. A gate, not a result.
The evaluation artefacts carry the source commit, the CI run and the checksums of the inputs. Rerun from a clean checkout of the named commit to reproduce.
Run 2026-06-11, commit 97752838, metrics file swat-gallery.json
Commit b4eab079, CI run 35477541192, evaluation report SHA-256 13da4918
Every detected SWaT attack, with the network and process evidence Vardar used, is published in the portal gallery.
The four-minute product film: the decision, the two evidence paths, the appliance and the boundary.
A finding from first alert to governed next step, in the console.
A technical evaluation on one critical process, with success criteria agreed in advance, produces the only number that matters for your site.