Intelligent Cybersecurity Frameworks for Detecting Data Manipulation, Sensor Spoofing, and Operational Anomalies in Critical Water Infrastructure

Abstract

Water utilities depend on telemetry that can be wrong for three very different reasons: an attacker has altered or replaced it, an instrument has failed, or the network itself has changed. We developed an intelligent cybersecurity framework that detects these situations and tells them apart. Four evidence layers are computed from SCADA tags alone: hydraulic consistency (tank mass balances, pump characteristics, main headloss, system water balance, night flow and pressure surrogates), signal integrity (instrument noise fingerprints, replay correlation and exact matches against the historian), learned consistency, and departure from the recent operational routine. A gradient boosted classifier trained on a digital twin attack library attributes each alarm to data manipulation, sensor spoofing or an operational anomaly, and a ranking step localises the affected instrument. The framework was tested on 180 days of EPANET simulation of the Net3 network with 21 tags and 52 test events in 13 scenarios. Calibration from telemetry recovered tank areas within 1.5 % and pump curves within 0.1 m. The framework detected 85 % of events, including all spoofing events, with an F1 score of 0.64 against 0.54 for an autoencoder, attributed 93 % of detected events to the correct family against 82 % to 85 % from raw features, and ranked the affected instrument first in 67 % of cases. Replay remained detectable when attackers added fresh noise, through its physical consequences. Physically consistent falsification, background leaks below 2 % of demand, and attack types absent from the training library were the main failure modes.