Traditional anomaly detectors in water treatment and distribution plants identify process anomalies only after their impact has been realized, limiting their ability to prevent disruptions or damage. This paper introduces the Programmable Logic Controller (PLC) Command Validation Tool (PCAT), an anomaly-avoidance framework that verifies the correctness of control commands issued by PLCs before they reach actuators. PCAT was evaluated on the Secure Water Treatment (SWaT) testbed under realistic attack scenarios inspired by real-world incidents. The framework demonstrated the ability to raise alerts significantly earlier than existing methods—triggering one alert 2.5 seconds in advance—thereby effectively preventing anomalies before physical damage occurred. Over six hours of normal operation, PCAT recorded zero false positives, confirming its precision and reliability. These findings position PCAT as a proactive and effective solution for securing water treatment operations.

A method referred to as PbNN is proposed to detect cyber-physical attacks through the identification of resulting anomalies in the process dynamics of the underlying ICS. Unlike existing anomaly detectors based on an abstract knowledge acquired from operational data, PbNN utilizes the design knowledge of ICS to learn the complex relationships among the correlated components. Such relationships are accurately modeled using operational data through the application of the deep convolution neural network. The proposed detector was implemented and evaluated in an operational secure water treatment plant by launching several real-time stealthy and coordinated attacks. The results indicate that PbNN outperforms the existing state-of-the-art machine learning anomaly detectors when compared using detection accuracy and the rate of false alarms.

A cyber-physical attack against critical infrastructures, such as water treatment and distribution plants, could lead to process anomalies. Several design and data centric approaches were developed to detect such anomalies when the physical processes of the underlying plant move from a normal to a malicious state. Although these approaches are necessary for the continued and reliable plant operation, they might not be sufficient to prevent service disruption or damage to components. This is because the impact of anomalies is already realized before the attack is detected. In this paper, we propose PCAT – PLC Command Analysis Tool that validates the control commands issued by the programmable logic controller (PLC). PCAT stops rogue attack commands before they reach the target actuators. In a case study, PCAT was deployed and validated on the operational water treatment plant named SWaT. The experimental results attest the performance of PCAT in ensuring the security, safety, and service status of the plant before it enters an anomalous state.

Abstract Gradual increase in the number of successful attacks against Industrial Control Systems (ICS) has led to an urgent need to create defense mechanisms for accurate and timely detection of the resulting process anomalies. Towards this end, a class of anomaly detectors, created using data-centric approaches, are gaining attention. Using machine learning algorithms such approaches can automatically learn the process dynamics and control strategies deployed in an ICS. The use of these approaches leads to relatively easier and faster creation of anomaly detectors compared to the use of design-centric approaches that are based on plant physics and design. Despite the advantages, there exist significant challenges and implementation issues in the creation and deployment of detectors generated using machine learning for city-scale plants. In this work, we enumerate and discuss such challenges. Also presented is a series of lessons learned in our attempt to meet these challenges in an operational plant.

The existence of a multitude of cloud service providers (CSPs) for each service type increases the difficulty in the identification of appropriate and trustworthy service providers based on their abilities and cloud users’ unique functional and non-functional quality-of-service (QoS) requirements. Further, the dynamic nature of the cloud ecosystem in terms of performance and new services increases the complexity of the cloud service selection problem. Trust-based service selection mechanisms which involve the intrinsic relations among the QoS parameters or trust measure parameters (TMPs) to evaluate the quality of the CSPs are the most preferred solution for the problem of cloud service selection. However, the accuracy of the trust-based service selection models and the CSP’s trust value relies on the optimality of the TMP subset obtained with respect to the service type. Hence, this work presents an efficient rough set theory-based hypergraph-binary fruit fly optimization (RST-HGBFFO), a cooperative bio-inspired technique to identify the optimal service-specific TMPs. Experiments on QWS dataset, Cloud Armor, and CISH—SASTRA trust feedback dataset reveal the predominance of RST-HGBFFO over the state-of-the-art feature selection techniques. The performance of RST-HGBFFO feature selection technique was validated using hypergraph-based computational model and WEKA tool in terms of reduct size, service ranking, classification accuracy, and time complexity.