A Causality-Inspired Approach for Anomaly Detection in a Water Treatment Testbed

Georgios Koutroulis, Belgin Mutlu, Roman Kern*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review


Critical infrastructure, such as water treatment facilities, largely relies on the effective functioning of industrial control systems (ICSs). Due to the wide adoption of high-speed network and digital infrastructure technologies, these systems are now highly interconnected not only to corporate networks but also to the public Internet, mostly for remote control and monitoring purposes. Sophisticated cyber-attacks may take advantage the increased interconnectedness or other security gaps of an ICS and infiltrate the system with devastating consequences to the economy, national security, and even human life. Due to the paramount importance of detecting and isolating these attacks, we propose an unsupervised anomaly detection approach that employs causal inference to construct a robust anomaly score in two phases. First, minimal domain knowledge via causal models helps identify critical interdependencies in the system, while univariate models contribute to individually learn the normal behavior of the system’s components. In the final phase, we employ the extreme studentized deviate (ESD) on the computed score to detect attacks and to exclude any irrelevant sensor signals. Our approach is validated on the widely used Secure Water Treatment (SWaT) benchmark, and it exhibits the highest F1 score with zero false alarms, which is extremely important for real-world deployment.

Original languageEnglish
Article number257
Issue number1
Early online date27 Dec 2022
Publication statusPublished - Jan 2023


  • anomaly detection
  • causal inference
  • convolutional neural networks
  • cyber-attacks
  • water treatment testbed

ASJC Scopus subject areas

  • Analytical Chemistry
  • Information Systems
  • Instrumentation
  • Atomic and Molecular Physics, and Optics
  • Electrical and Electronic Engineering
  • Biochemistry


Dive into the research topics of 'A Causality-Inspired Approach for Anomaly Detection in a Water Treatment Testbed'. Together they form a unique fingerprint.

Cite this