Where it hit the plant
primary grid, raw-water intake & dosing
elevated reservoir, secondary distribution
consumer / return network
Attack window and detections
Shaded band: the labelled attack window from the iTrust ground-truth catalog. Marks: the first second each engine flagged the window. "No flag" means the engine stayed silent for the whole window.
Why it was flagged
At 2017-10-10 10:24:10, attack #2 (SSSP) manipulated 1FIT001 — “Chemical dosing pumps start (increase of chemical dosing)”. The serving model raised the alert 179 seconds after onset (peak score 2.649x the operating threshold). The dominant physical evidence: 1MV001 — primary-grid raw-water inlet motorized valve, Stage 1 (primary grid — raw-water intake & dosing) was driven to a state the plant's learned physics did not predict from the rest of the process, carrying 15% of the anomaly score — 32.1x its share in normal operation. Supporting deviations were concentrated in 1FIT001, 2LS401, 1P001. In plain terms: the plant's own physics stopped agreeing with what the sensors were reporting, in exactly the part of the process the attacker touched.
Sensors carrying the anomaly score
| Sensor | Share of score | Deviation | Share vs normal |
|---|---|---|---|
| 1MV001 primary-grid raw-water inlet motorized valve, Stage 1 (primary grid — raw-water intake & dosing) | 14.6% | 13.8σ | 32.1x |
| 1FIT001 primary-grid inlet flow meter (chemical-dosing line), Stage 1 (primary grid — raw-water intake & dosing) | 10.9% | 10.4σ | 16.2x |
| 2LS401 level switch, Stage 2 (elevated reservoir — secondary distribution) | 6.7% | 6.1σ | 10.2x |
| 1P001 raw-water transfer pump P1, Stage 1 (primary grid — raw-water intake & dosing) | 5.6% | 8.3σ | 49.9x |
| 1P003 chemical-dosing pump P3, Stage 1 (primary grid — raw-water intake & dosing) | 5.5% | 8.2σ | 34.5x |
| 2LS101 level switch, Stage 2 (elevated reservoir — secondary distribution) | 5.3% | 5.0σ | 8.4x |
| 1MV004 motorized valve, Stage 1 (primary grid — raw-water intake & dosing) | 5.1% | 4.7σ | 2.3x |
| 2MCV601 motorized control valve, Stage 2 (elevated reservoir — secondary distribution) | 3.0% | 3.2σ | 2.6x |
Every figure has a run.
2026-06-13T22:27:18Z, commit de79dac5398150de9bc5eda89a529d2dbb942c6c
sha-de79dac53981
a05be50d6a12ad442d292f0b9759d4087430c537fcc3b93712812ff55d5605bb
2026-06-14T18:37:06Z
ce5f77ae0bc78a0576ec3ca053b5594844039f7f77c0aa2ba63850a9bf46874f
vardar-portal/scripts/build-gallery-data.mjs (DEL-34/DEL-43)
SWaT and WaDi datasets courtesy of iTrust, Centre for Research in Cyber Security, Singapore University of Technology and Design. Detection figures trace to the reproducible model runs shown with each dataset.
The next record is your process.
A technical evaluation on one critical process, with success criteria agreed in advance, produces the only figure that applies to your site.