The rise in attempted and successful attacks on critical infrastructure, such as power grid and water treatment plants, has led to an urgent need for the creation and adoption of methods for detecting such attacks often launched either by insiders or state actors. This paper focuses on one such method that aims at the detection of attacks that compromise one or more actuators and sensors in a plant either through successful intrusion in the plant's communication network or directly through the plant computers. The method, labelled as Distributed Attack Detection (DAD), detects attacks in real-time by identifying anomalies in the behavior of the physical process in the plant. Anomalies are identified by using monitors that are implementations of invariants derived from the plant design. Each invariant must hold either throughout the plant operation, or when the plant is in a given state. The effectiveness of DAD was assessed experimentally on an operational water treatment plant named SWaT that is a near-replica of commercially available large treatment plants. The method used in DAD was found to be effective in detecting stealthy and coordinated attacks.

An experimental investigation was undertaken to understand the impact of single-point cyber attacks on a Secure Water Treatment (SWaT) system. Cyber attacks were launched on SWaT through its SCADA server that connects to the Programmable Logic Controllers (PLCs) that in turn are connected to sensors and actuators. Attacks were designed to meet attacker objectives selected from a novel attacker model. Outcome of the experiments led to a better understanding of (a) the propagation of an attack across the system measured in terms of the number of components affected and (b) the behavior of the water treatment process in SWaT in response to the attacks. The observed response to various attacks was then used to propose attack detection mechanisms based on various physical properties measured during the treatment process.

A method referred to as PbNN is proposed to detect cyber-physical attacks through the identification of resulting anomalies in the process dynamics of the underlying ICS. Unlike existing anomaly detectors based on an abstract knowledge acquired from operational data, PbNN utilizes the design knowledge of ICS to learn the complex relationships among the correlated components. Such relationships are accurately modeled using operational data through the application of the deep convolution neural network. The proposed detector was implemented and evaluated in an operational secure water treatment plant by launching several real-time stealthy and coordinated attacks. The results indicate that PbNN outperforms the existing state-of-the-art machine learning anomaly detectors when compared using detection accuracy and the rate of false alarms.