# Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning

arXiv: https://arxiv.org/abs/1709.05342 · HTML: https://mlsanity.com/paper/1709.05342/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Sep 2017.

## Built on by (most cited first, 18 of 18)

- [Unsupervised Deep Learning for IoT Time Series](https://mlsanity.com/paper/2302.03284/) (2023)
- [Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations](https://mlsanity.com/paper/2202.11917/) (2022)
- [Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems](https://mlsanity.com/paper/2105.10707/) (2021)
- [Unsupervised Ensemble Methods for Anomaly Detection in PLC-based Process Control](https://mlsanity.com/paper/2302.02097/) (2023)
- [Attention and Autoencoder Hybrid Model for Unsupervised Online Anomaly Detection](https://mlsanity.com/paper/2401.03322/) (2024)
- [A Giant-Step Baby-Step Classifier For Scalable and Real-Time Anomaly Detection In Industrial Control Systems and Water Treatment Systems](https://mlsanity.com/paper/2504.20906/) (2025)
- [Runtime Anomaly Detection for Drones: An Integrated Rule-Mining and Unsupervised-Learning Approach](https://mlsanity.com/paper/2505.01947/) (2025)
- [Adversarial Sample Generation for Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2505.03120/) (2025)
- [Batch Distillation Data for Developing Machine Learning Anomaly Detection Methods](https://mlsanity.com/paper/2510.18075/) (2025)
- [Code Integrity Attestation for PLCs using Black Box Neural Network Predictions](https://mlsanity.com/paper/2106.07851/) (2021)
- [Two-phase Dual COPOD Method for Anomaly Detection in Industrial Control System](https://mlsanity.com/paper/2305.00982/) (2023)
- [An Attention-Based Deep Generative Model for Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2405.05277/) (2024)
- [Hypergraph-based multi-scale spatio-temporal graph convolution network for Time-Series anomaly detection](https://mlsanity.com/paper/2410.22256/) (2024)
- [iADCPS: Time Series Anomaly Detection for Evolving Cyber-physical Systems via Incremental Meta-learning](https://mlsanity.com/paper/2504.04374/) (2025)
- [Automated Batch Distillation Process Simulation for a Large Hybrid Dataset for Deep Anomaly Detection](https://mlsanity.com/paper/2604.09166/) (2026)
- [Ti-iLSTM: A TinyDL Approach for Logic-Level Anomaly Detection in Industrial Water Treatment Systems](https://mlsanity.com/paper/2605.15874/) (2026)
- [Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination](https://mlsanity.com/paper/2608.23547/) (2026)
- [Where Root Cause Analysis Fails: A Retrieval-Reranking Decomposition](https://mlsanity.com/paper/2609.36686/) (2026)

## Abstract (arXiv)

In this paper, we propose and evaluate the application of unsupervised machine learning to anomaly detection for a Cyber-Physical System (CPS). We compare two methods: Deep Neural Networks (DNN) adapted to time series data generated by a CPS, and one-class Support Vector Machines (SVM). These methods are evaluated against data from the Secure Water Treatment (SWaT) testbed, a scaled-down but fully operational raw water purification plant. For both methods, we first train detectors using a log generated by SWaT operating under normal conditions. Then, we evaluate the performance of both methods using a log generated by SWaT operating under 36 different attack scenarios. We find that our DNN generates fewer false positives than our one-class SVM while our SVM detects slightly more anomalies. Overall, our DNN has a slightly better F measure than our SVM. We discuss the characteristics of the DNN and one-class SVM used in this experiment, and compare the advantages and disadvantages of the two methods.