VardarCyber-physical securityEvaluate one critical process
Public ICS evidence / reproducible runs

Real attacks on real testbeds.What was caught, and why.

Labelled attacks from two public ICS datasets, replayed through the Vardar detection stack. Every record shows the plant stage the attacker touched, the detection timeline and the per-sensor evidence behind the result. Public, no login.

PublicNo loginTwo testbedsEight walkthroughs
1.0Evidence surface

What every record carries

01Labelled attack

A known event with a defined start, duration and intended impact, from the iTrust ground-truth catalog.

02Detection timeline

When each engine flagged the window, measured from the labelled onset, and which engines never did.

03Sensor-level explanation

The process signals that support the result, not only the verdict.

2.0Dataset 01

SWaT 2015

iTrust Secure Water Treatment testbed (SUTD). A six-stage plant, 36 labelled attacks over four attack days.

Water Treatment5 caught attacks shown
32 / 36
labelled attacks detected
99.1%
precision
0.55%
holdout false-positive rate
85.5%
point-adjusted recall

Provenance Recall is point-adjusted on labelled attacks; the false-positive rate is measured on held-out clean data. Every figure traces to the run, the model image and the artefact checksum shown here. Validation run 2026-06-11T22:34:18Z, model image sha-97752838a3f3, metrics artefact SHA-256 80c98149b000d88af3fc7b58ab407a24c81f3839426e7d4e53c2011bbf15c52a.

Attack #28Single Stage, Single Point

P302

UF feed pump

Intended impact: Stop inflow of tank T-401

Onset
2015-12-31 01:45:19
Window
570m 13s
First catch
13m 10s
  • Physical Residual
  • Temporal Sequence
  • Process Invariants
  • Fused Ensemble
Walk through the attack
Attack #22Multi Stage, Multi Point

UV401 + AIT502 + P501

UV dechlorinator unit; RO feed ORP analyzer; RO high-pressure pump

Intended impact: Possible damage to RO

Onset
2015-12-29 22:55:18
Window
7m 47s
First catch
instant
  • Physical Residual
  • Temporal Sequence
  • Process Invariants
  • Fused Ensemble
Walk through the attack
Attack #37Single Stage, Multi Point

P501 + FIT502

RO high-pressure pump; RO permeate flow meter

Intended impact: Reduced output

Onset
2015-01-02 11:17:02
Window
7m 53s
First catch
44s
  • Physical Residual
  • Temporal Sequence
  • Process Invariants
  • Fused Ensemble
Walk through the attack
Attack #6Single Stage, Single Point

AIT202

pH analyzer (HCl dosing control)

Intended impact: P-203 turns off; Change in water quality

Onset
2015-12-28 12:00:55
Window
3m 20s
First catch
instant
  • Physical Residual
  • Temporal Sequence
  • Process Invariants
  • Fused Ensemble
Walk through the attack
Attack #20Single Stage, Single Point

AIT504

RO permeate conductivity analyzer

Intended impact: RO shut down sequence starts after 30 minutes. Water should go to drain.

Onset
2015-12-29 18:15:43
Window
6m 39s
First catch
instant
  • Physical Residual
  • Temporal Sequence
  • Process Invariants
  • Fused Ensemble
Walk through the attack
3.0Dataset 02

WaDi 2017

iTrust Water Distribution testbed (SUTD). A three-stage distribution network, 16 labelled attacks.

Water Distribution3 caught attacks shown
15 / 16
labelled attacks detected
90.7%
precision
2.07%
holdout false-positive rate
100.0%
point-adjusted recall

Provenance Recall is point-adjusted on labelled attacks; the false-positive rate is measured on held-out clean data. Every figure traces to the run, the model image and the artefact checksum shown here. Validation run 2026-06-13T22:27:18Z, model image sha-de79dac53981, metrics artefact SHA-256 a05be50d6a12ad442d292f0b9759d4087430c537fcc3b93712812ff55d5605bb.

Attack #10Single Stage, Multi Point

1P005ON + 1P006OFF

raw-water booster pump P5 (commanded ON); raw-water booster pump P6 (commanded OFF)

Onset
2017-10-11 10:55:00
Window
1m 32s
First catch
7s
  • Physical Residual
Walk through the attack
Attack #2Single Stage, Single Point

1FIT001

primary-grid inlet flow meter (chemical-dosing line)

Intended impact: No increase in level in primary grid

Onset
2017-10-10 10:24:10
Window
9m 55s
First catch
2m 59s
  • Physical Residual
Walk through the attack
Attack #16Single Stage, Single Point

2LIT002

elevated-reservoir tank level transmitter

Intended impact: Stealthy attack

Onset
2017-07-11 15:26:30
Window
10m 35s
First catch
4m 43s
  • Physical Residual
Walk through the attack

SWaT and WaDi datasets courtesy of iTrust, Centre for Research in Cyber Security, Singapore University of Technology and Design. Detection figures trace to the reproducible model runs shown with each dataset.

The next record is your process.

A technical evaluation on one critical process, with success criteria agreed in advance, produces the only figure that applies to your site.

Evaluate one critical process