Where it hit the plant
primary grid, raw-water intake & dosing
elevated reservoir, secondary distribution
consumer / return network
Attack window and detections
Shaded band: the labelled attack window from the iTrust ground-truth catalog. Marks: the first second each engine flagged the window. "No flag" means the engine stayed silent for the whole window.
Why it was flagged
At 2017-07-11 15:26:30, attack #16 (SSSP) manipulated 2LIT002 — “Overflow of Elevated Reservoir tank”. The serving model raised the alert 283 seconds after onset (peak score 1.0596x the operating threshold). The dominant physical evidence: 2MV006 — motorized valve, Stage 2 (elevated reservoir — secondary distribution) was driven to a state the plant's learned physics did not predict from the rest of the process, carrying 7% of the anomaly score — 10.5x its share in normal operation. Supporting deviations were concentrated in 2P003, 2P003SPEED, 1AIT003. In plain terms: the plant's own physics stopped agreeing with what the sensors were reporting, in exactly the part of the process the attacker touched.
Sensors carrying the anomaly score
| Sensor | Share of score | Deviation | Share vs normal |
|---|---|---|---|
| 2MV006 motorized valve, Stage 2 (elevated reservoir — secondary distribution) | 6.6% | 5.5σ | 10.5x |
| 2P003 pump, Stage 2 (elevated reservoir — secondary distribution) | 6.5% | 5.3σ | 8.5x |
| 2P003SPEED pump, Stage 2 (elevated reservoir — secondary distribution) | 5.0% | 4.1σ | 5.5x |
| 1AIT003 water-quality analyzer, Stage 1 (primary grid — raw-water intake & dosing) | 4.8% | 4.0σ | 2.7x |
| 1AIT005 water-quality analyzer, Stage 1 (primary grid — raw-water intake & dosing) | 3.9% | 3.2σ | 1.9x |
| 2PIT001 pressure transmitter, Stage 2 (elevated reservoir — secondary distribution) | 3.7% | 3.0σ | 3.0x |
| 2_FIC_401_PV plant instrument, Stage 2 (elevated reservoir — secondary distribution) | 3.1% | 2.6σ | 5.1x |
| 2_FIC_501_SP plant instrument, Stage 2 (elevated reservoir — secondary distribution) | 3.0% | 2.5σ | 1.5x |
Every figure has a run.
2026-06-13T22:27:18Z, commit de79dac5398150de9bc5eda89a529d2dbb942c6c
sha-de79dac53981
a05be50d6a12ad442d292f0b9759d4087430c537fcc3b93712812ff55d5605bb
2026-06-14T18:37:06Z
ce5f77ae0bc78a0576ec3ca053b5594844039f7f77c0aa2ba63850a9bf46874f
vardar-portal/scripts/build-gallery-data.mjs (DEL-34/DEL-43)
SWaT and WaDi datasets courtesy of iTrust, Centre for Research in Cyber Security, Singapore University of Technology and Design. Detection figures trace to the reproducible model runs shown with each dataset.
The next record is your process.
A technical evaluation on one critical process, with success criteria agreed in advance, produces the only figure that applies to your site.