SWaT Industrial Control Security Research.
Cairo, Egypt
Source: SWaT forecasting + classification reports
A combined research track on the Secure Water Treatment testbed, spanning multivariate time-series forecasting for anomaly surfacing and supervised deep learning for cyberattack detection and attack-point classification.
Industrial control systems cannot be monitored well with a single modeling lens. Operators need both a sense of what the process should do next and a way to recognize when observed behavior matches a known attack pattern.
This SWaT research portfolio tackled both sides of that problem on the same water-treatment testbed: forecasting future sensor and actuator behavior to expose anomalies early, then classifying normal versus attack states and pinpointing the attacked infrastructure components.
The first track focused on multivariate time-series forecasting over SWaT sensor and actuator readings, comparing LSTM, BiLSTM, and BiGRU encoder-decoder style models, then adding quantile mapping and ensembles to improve forecast quality and tolerance-band coverage.
The second track treated the same domain as a supervised cyberattack-detection problem. I benchmarked LSTM, CNN, CNN-LSTM, and MLP-based variants for binary normal-versus-attack detection and for multi-label attack-point classification across the SWaT A1 and A2-Dec 2015 data.
- →Used the SWaT A1 and A2-Dec 2015 dataset with 51 process features and 26 labeled attack points from a realistic secure water-treatment testbed.
- →Reached macro F1 scores above 98.9% for binary attack detection, with CNN-LSTM peaking at 99.3%.
- →Improved multi-label attack-point classification to 99.6% macro F1 through a majority-voting ensemble.
- →Found BiGRU to be the strongest standalone forecasting model, with 1.1968 MAE, 44.8929 MSE, 6.7002 RMSE, 0.9990 R-squared, and 96.11% within a 15% tolerance range.
- →Pushed forecasting further with ensemble strategies, including a lowest-MAE ensemble at 1.1090 and a highest-tolerance ensemble at 96.80% PWT.
- →Built a more complete ICS-security story than a single paper alone: one line of work predicts how the plant should behave, while the other identifies when and where an attack is happening.
- →Demonstrated that deep learning can support both proactive anomaly surfacing and high-confidence supervised detection on multivariate industrial telemetry.
- →Strengthened the portfolio narrative from model benchmarking to cyber-physical operations: forecasting accuracy, attack detection, attack localization, and decision support all connect.
Multivariate time-series forecasting for sensor and actuator readings, used as an early anomaly-surfacing layer for secure water-treatment operations.
Supervised deep-learning pipelines for binary attack detection and multi-label attack-point classification across the same industrial control environment.