AquaSense-ICS: A Hybrid Real-Simulated Cyber-Physical Dataset and Leakage-Aware Benchmark for Smart Water Quality Monitoring and Attack Detection

AquaSense-ICS: A Hybrid Real–Simulated Cyber-Physical Dataset and Leakage-Aware Benchmark for Smart Water Quality Monitoring and Attack Detection Amal NEJIa , Mohamed FOURATIa , Lamia CHAARI FOURATIa,∗ a Digital Research Center of Sfax (CRNS), Laboratory of Signals, Systems, Artificial Intelligence and Networks (SM@RTS), Sfax, Tunisia

Abstract

arXiv:2610.32661v1 [cs.CR] 23 Oct 2026

Machine-learning research on water cyber-physical systems (CPS) is constrained by datasets that are either real but chemically poor, or simulated but free of sensing noise and attacks. We present AquaSense-ICS, an open dataset and benchmark that coregisters (i) a 25.4 h recording window (8.0 h of recorded data, 26% coverage) from a Raspberry Pi 5 edge node (TDS probe and BME680 ambient sensor, 1–2 s sampling, 23,688 records), with (ii) a looped network of 13 nodes (10 junctions, 2 reservoirs, 1 tank) simulated in EPANET-MSX for six water-quality species, (iii) a parameterised library of cyber-attacks (false data injection, replay, denial of service, drift) and unintentional sensor faults with sample-level ground truth, and (iv) augmented and TimeGANgenerated sequences, flagged by an origin column. The attack, fault and water-quality labels are traceable to a seeded generator, a documented rule or a simulation input. We show that the most common way of benchmarking such hybrid data, random row splits and labels computed from the input features, yields near-perfect but uninformative scores (macro-F1 = 0.9998 for Random Forest), and we replace it with a leakage-aware protocol using chronological splits and held-out attack types rather than label reconstruction. Under this protocol, no model exceeds the constant “normal” predictor for attack classification (macro-F1 = 0.465), and the best detectors reach a mean AUROC of 0.64 on attack types unseen during training (0.35–0.93 depending on the type), leaving substantial headroom. Data and simulation files are released under CC BY 4.0 at https://doi.org/10.5281/zenodo. 23390541, and attack generators and benchmark code under MIT. Keywords: Water distribution network, Cyber-physical security, IoT dataset, EPANET-MSX, False data injection, Anomaly detection, Data leakage, Explainable AI

1. Introduction 1.1. Motivation Water is a fundamental resource for human health, food security, industry, and ecosystem sustainability. However, urbanization, industrial discharge, agricultural pollution, and climate change are accelerating water stress worldwide. Around 2.4 billion people lived in water-stressed countries in 2020 [1], about two billion lack safely managed drinking water [2], and microbiologically contaminated drinking water is estimated to cause about 505,000 diarrhoeal deaths each year [3], highlighting the critical importance of continuous water quality monitoring for public health and sustainability. 1.2. IoT-Based Monitoring and Cyber-Physical Systems Traditional water quality monitoring relies on laboratory sampling, which is accurate but costly, delayed, and unsuitable for real-time decision-making. In contrast, IoT technologies enable continuous in-situ sensing and remote monitoring using low-cost sensors [4, 5, 6]. Parameters such as pH, conductivity, turbidity, temperature, and total dissolved solids can now ∗ Corresponding author

Email address: lamia.chaari@isims.usf.tn (Lamia CHAARI FOURATI)

be tracked in real time [7]. Moreover, modern water infrastructures increasingly rely on cyber-physical systems (CPS), which integrate sensing, communication, and control layers, improving efficiency while introducing new security risks. 1.3. Artificial Intelligence for Smart Water Systems Artificial intelligence and machine learning have become essential for anomaly detection, forecasting, and intelligent water management. Deep learning models such as RNNs, Transformers, and graph neural networks have demonstrated strong performance in time-series analysis, including attack detection in water distribution networks [8, 9]. Their progress, however, depends on datasets whose labels are trustworthy and whose evaluation protocols do not leak information from test to training data, a problem now recognised as a leading cause of irreproducible results in ML-based science [10]. 1.4. Cybersecurity Risks in Water Infrastructure The digitalization of water systems increases exposure to cyber-physical attacks. Water networks are high-value targets where malicious actions such as false data injection [11], replay attacks, denial-of-service, and drift attacks can silently manipulate sensor data and disrupt system operation [12, 13]. These threats highlight the need for datasets containing realistic and reproducible attack scenarios for robust anomaly detection research.

1.5. Research Gap in Existing Datasets • Traceable labelling: Separate water-quality, attack and fault labels, each derived from regulatory thresholds or Despite recent advances, existing datasets remain limited. from the generator (Section 6). Benchmarks such as BattLeDIM (on the L-TOWN network) [14] and BATADAL [12] provide valuable simulation-based eval• Leakage-aware benchmark: We quantify how random uation environments, but lack real IoT sensing and (for Batsplits and feature-derived labels inflate scores, and define tLeDIM) attack scenarios. Testbed datasets such as SWaT and tasks with chronological and leave-attack-type-out splits WADI [15, 16, 17] contain real sensors and attacks but only a (Sections 8–9). few water-quality analysers and no multi-species network chemistry. Other datasets are often short-term, single-node, or parameter• Reproducibility: Code, the .inp/.msx files, random seeds limited, failing to capture the complexity of real water netand a datasheet [20] following FAIR principles [21]. works. To the best of our knowledge, no existing dataset simultaneously integrates real IoT sensing, EPANET-MSX multi-species 1.9. Paper Organization simulation, cyber-physical attacks, time-series augmentation, The remainder of this paper is organized as follows. Secand interpretable physicochemical labeling , nor provides an tion 2 reviews related datasets. Section 3 describes real data evaluation protocol that controls for the leakage such hybrid acquisition, Section 4 the EPANET-MSX simulation, and Secdata invite. tion 5 augmentation, attacks and faults. Section 6 covers fusion and labelling, Section 7 dataset analysis, Section 8 the bench1.6. Proposed Dataset and Framework mark and Section 9 explainability. Section 10 documents the To address these limitations, this paper introduces a hybrid release and Section 11 concludes with limitations. Figure 1 ilcyber-physical smart water quality dataset combining real IoT lustrates the overall organization and methodological workflow measurements, EPANET-MSX simulations, adversarial perturof the proposed framework. bations, and time-series augmentation within a unified temporal 1.10. List of Acronyms framework. The IoT layer is built using a Raspberry Pi 5 platform with BME680 and TDS sensors, capturing ambient (air) The acronyms used in this paper are summarized in Table 1. environmental and water quality variables over a 25.4,h monitoring window. The simulation layer uses EPANET-MSX [18, 2. Related Work 19] to model multi-species water dynamics including chlorine decay, pH variation, conductivity, dissolved oxygen, and tri2.1. Overview of Existing Datasets for Smart Water Systems halomethanes. A temporal fusion strategy aligns real and simThe development of data-driven methods for smart water ulated data on a common elapsed-time axis. We state explicmanagement has been supported by a growing but still limitly that the fusion is a co-registration: the real sensor did not ited number of publicly available datasets. These resources measure the simulated network, so cross-source relations in the can be broadly categorized into four classes: real IoT sensing fused table are synthetic by design and are documented as such. datasets, hydraulic simulation benchmarks, cyber-physical attack datasets, and hybrid resources. Table 2 provides a com1.7. Research Questions parative summary of the most representative existing datasets The paper answers three questions: RQ1 Can a low-cost alongside the proposed benchmark. edge node and a multi-species network model be combined into a dataset whose every label is traceable and reproducible? RQ2 2.2. Real Testbed and Sensing Datasets How much of the apparent performance on such hybrid data is The Secure Water Treatment (SWaT) testbed, introduced caused by evaluation leakage, and what protocol removes it? by Mathur and Tippenhauer (2016) [15], is a fully operational RQ3 Under a leakage-aware protocol, how well do standard scaled-down water treatment facility; its public dataset [16] inmodels detect and classify attacks, including attack types never cludes both normal operations and 36 executed cyberattack sceseen in training, and which signals do they rely on? narios recorded over 11 days[15]. Although SWaT provides real sensor measurements and attack labels, it targets a treat1.8. Main Contributions ment plant rather than a distribution network, and does not inThe main contributions are summarized as follows: clude hydraulic simulation, multi-species chemical modeling, or time-series augmentation. The WADI (Water Distribution) • Dataset: An open hybrid dataset co-registering a real dataset, proposed by Ahmed et al. (2017) as a follow-up to 25.4 h edge-sensing recording and a 6-species EPANETSWaT, extends the testbed to a water distribution infrastructure MSX network simulation, released as linked raw, simand similarly provides labeled attack scenarios.[17] However, ulated, attacked and fused tables with a data dictionary both SWaT and WADI remain confined to controlled labora(Section 10). tory environments and include only a few water-quality analy• Attack and fault library: A seeded generator for five sers (e.g., pH, conductivity and ORP in SWaT); network-scale attack types (including stealthy FDI) and three fault types species such as chlorine residual, dissolved oxygen and with sample-level labels, applied to real and simulated trihalomethanes are absent, and access requires a request to channels (Section 5). the operating institution. 2

Introduction

Related Datasets

Real Data Acquisition

Dataset Analysis

Augmentation, Attacks and Faults

EPANET–MSX Simulation

Temporal Fusion and Labelling

Benchmark Evaluation

Explainability Analysis

Conclusion, Limitations and Future Work

Dataset Availability and Release

Figure 1: Roadmap of the paper and methodological workflow. The study progresses from related datasets and real-world data acquisition to EPANET–MSX simulation, cyber-physical perturbation generation, temporal fusion and labelling, dataset analysis, benchmarking, explainability, and finally dataset release and discussion of limitations and future work.

Table 1: Principal acronyms used in this paper

Acronym

Definition

Acronym

Definition

ADC BATADAL BattLeDIM

Analog-to-digital converter Battle of the Attack Detection Algorithms Battle of the Leakage Detection and Isolation Methods Wall chlorine demand (MSX wall species) Electrical conductivity Cyber-physical system Dissolved oxygen Denial of service False data injection False-alarm rate Leave-one-attack-type-out split Leave-one-event-type-out split

MSX NTU RH

Multi-Species eXtension (EPANET) Nephelometric turbidity unit Relative humidity

SHAP SWaT TDS THM TSTR TURB VOC WADI WDN

SHapley Additive exPlanations Secure Water Treatment testbed Total dissolved solids Trihalomethanes Train on synthetic, test on real Turbidity Volatile organic compounds Water Distribution testbed Water distribution network

ClD COND CPS DO DoS FDI FAR LOAO LOEO

The WaterBench dataset, released by the Open Water AI Initiative (2022), provides real IoT measurements from deployed sensors but lacks attack scenarios, quality labels, and augmentation pipelines, limiting its applicability for cybersecurity and machine learning benchmarking.[22] More broadly, survey papers covering IoT water quality datasets (2019–2024) consistently highlight the absence of unified resources that combine sensing, simulation, security, and labeling within a single open benchmark.[23] Reviews of low-cost and IoT water-quality monitoring [5, 6, 4] report that most deployments are short, single-site and unlabelled, and that openly released raw data with documented calibration remain rare.

bution systems and has been widely used to generate synthetic datasets for pressure monitoring, leakage detection, and demand forecasting. However, standard EPANET tracks a single water-quality constituent and does not capture the multi-species chemical dynamics including chlorine decay, trihalomethane formation, pH variation, and dissolved oxygen evolution that are critical for water quality analysis. The EPANET-MSX extension [18] addresses this limitation by enabling multi-species reaction modeling within distribution networks, yet datasets generated using EPANET-MSX remain scarce and have not been integrated with real sensor observations or cybersecurity scenarios. The BattLeDIM competition (Vrachimis et al., 2022), based on the L-TOWN network, provided a valuable benchmark for leakage detection and isolation using SCADA-simulated measurements of flow, pressure, and tank levels. While BattLeDIM established a rigorous evaluation framework, it relies entirely on simulated data and does not incorporate water quality parameters or cyber-attacks.[14] The LeakDB benchmark similarly offers simulated leakage scenarios across multiple net-

2.3. Hydraulic Simulation Benchmarks Simulation-based datasets have been the dominant resource in water network research. EPANET, developed by Rossman (2000) at the US Environmental Protection Agency [24, 25], remains the standard tool for hydraulic modeling of water distri3

work topologies but lacks quality modeling and real sensing integration.[26]

post-hoc analysis. The edge-first design minimizes latency and network dependency, making the system suitable for deployment in resource-constrained environments.

2.4. Cyber-Physical Attack Datasets 3.2. Sensors and Hardware Configuration Two main sensing modules were employed in the experimental setup, selected for their complementary measurement capabilities, compact form factors, and compatibility with the Raspberry Pi GPIO interface:

The BATADAL (Battle of the Attack Detection Algorithms) competition (Taormina et al., 2018) represents the most widely cited benchmark for cyber-physical attack detection in water distribution systems. BATADAL provided simulated SCADA observations from the C-Town network under a set of labelled attack events, enabling the evaluation of detection algorithms across multiple teams. Despite its significant impact, BATADAL relies exclusively on hydraulic simulation and does not include real IoT measurements, water quality parameters, or time-series augmentation.[12] It spawned a line of detectors based on autoencoders [8], hydraulic models [13], classical anomaly detection [27] and temporal graph networks [9], all evaluated on hydraulic (not chemical) signals. The KIOS research center datasets associated with BattLeDIM provide structured anomaly labels but similarly lack cybersecurity enrichment and multispecies chemical variables[28].

• TDS Sensor (DAR-02-W40): – Measures Total Dissolved Solids (TDS) in water, reflecting overall salinity and impurity concentration. – Outputs an analog voltage signal proportional to ion concentration, which is digitized by the ADS1115 ADC before transmission to the Raspberry Pi. – Selected for its cost-effectiveness and suitability for embedded analog acquisition pipelines. • BME680 Environmental Sensor (Bosch):

2.5. Limitations of Existing Resources and Motivation Despite the progress outlined above, a critical gap persists in the literature. As summarized in Table 2, no existing publicly available dataset simultaneously offers real edge sensing, multispecies hydraulic and chemical simulation, parameterised attack and fault labels, time-series augmentation kept separate from real data, interpretable physicochemical quality labeling, and full reproducibility. Equally important, none of these resources specifies an evaluation protocol that guards against temporal and label leakage [29, 10]. This gap motivates the design of the proposed dataset and benchmark.

– A multifunction MEMS sensor providing simultaneous measurement of air temperature (◦ C), relative humidity (%), barometric pressure (hPa), and gas resistance (Ω) [30]. – Gas resistance values are inversely correlated with volatile organic compound (VOC) concentration, making the sensor sensitive to gaseous pollution events. – Communicates directly with the Raspberry Pi via the I2C bus using Adafruit’s CircuitPython library. – The BME680 sensor was positioned above the water surface to characterise the ambient environment of the monitoring station. During perturbation experiments, the sensor was progressively moved closer to and then farther away from the perturbation source to capture the effect of varying proximity. Barometric pressure is measured by the BME680 but is not consistently recorded across all experimental runs and is excluded from the release.

3. Measurement Architecture and Real Data Acquisition This section presents the experimental platform developed for real-time monitoring of water quality and environmental conditions. It describes the proposed IoT architecture, sensing devices, hardware/software configuration, and the methodology adopted for data acquisition and preprocessing. The platform was designed to serve as a cyber-physical testbed, enabling both machine learning model training and anomaly detection evaluation under realistic and controlled operating conditions.

The physical testbed consists of a water container simulating a monitored water source. External perturbation sources are introduced in the vicinity of the sensing unit to emulate realistic environmental disturbances.

3.1. Proposed IoT Architecture The proposed monitoring platform is centered on a Raspberry Pi 5, which serves as the main edge-computing unit responsible for sensor interfacing, data acquisition, local storage, and wireless transmission. The system integrates water-quality sensing and environmental monitoring modules within a unified IoT architecture, as illustrated in Figure 2. The Raspberry Pi communicates with digital sensors through the I2C serial protocol and acquires analog measurements via an external ADS1115 analog-to-digital converter (ADC). Collected measurements are stored locally in CSV format and can be remotely accessed via Wi-Fi for real-time supervision and

3.3. TDS Measurement and Limitations The TDS probe provides an analog voltage V digitised by the ADS1115. The released column tds_value is the output of the acquisition script, TDS =

V × 0.5 , 1 + α(T a − 25)

α = 0.02 ◦ C−1 ,

(1)

where T a is the BME680 air temperature. This expression is a scaled voltage, not a calibrated concentration: the probe was 4

Table 2: Comparative analysis of existing smart water datasets (✓ = yes, ◦ = partial, × = no). Columns revised to separate real water-quality sensing from ambient sensing and to add the evaluation protocol. Real Real WQ Network Multi- Attack Fault Synthetic / Leakage- Access sensors analysers simulation species labels labels augmented aware split

Dataset

SWaT [15, 16] WADI [17] BATADAL [12] BattLeDIM / L-TOWN [14] LeakDB [26]

✓ ✓ × × ×

◦ ◦ × × ×

× × ✓ ✓ ✓

× × × × ×

✓ ✓ ✓ × ×

× × × × ×

× × × × ×

× × ◦ ◦ ×

On request On request Open Open Open

AquaSense-ICS (this work)

✓

◦

✓

✓

✓

✓

✓

✓

Open (CC BY 4.0)

Figure 2: Overall IoT architecture and data flow of the proposed monitoring platform.

not calibrated against standard solutions, the raw voltage was not retained, and the values (0.007–1.196) are not expressed in ppm. The column is therefore released without a unit. No immersed temperature probe was available, so the compensation uses the ambient air temperature, which adds a further uncertainty.

Table 3: Measurement ranges and operating thresholds. Parameter

Unit

Normal Range

Threshold / Classification

Ref.

Air temperature Relative Humidity Gas Resistance TDS

◦

10-30 25-80 8k-200k <600

<10 or >30: abnormal <25 or >80: abnormal <8,000: poor air quality <300: excellent; 300-600: good; >600: poor

[32] [32] [30] [31]

C % Ω ppm

These thresholds were subsequently used for automated anomaly detection and binary ambient-anomaly labelling (env_flag), which is distinct from the water-quality label of Section 6.3.

3.4. Measurement Ranges and Operating Thresholds To ensure reliable interpretation of sensor readings and to support rule-based anomaly labeling, operating thresholds were defined based on WHO drinking water quality guidelines [31] and standard indoor-environment reference ranges. Table 3 summarizes the operational ranges used in this study. Air temperature was considered normal within the range of 10– 30◦ C, while values outside this interval were flagged as anomalous. Relative humidity was constrained between 25–80%, corresponding to stable indoor environmental conditions. Gas resistance values from the BME680 sensor were interpreted as indicators of air quality, with acceptable operation between 8,000 and 200,000 Ω, where lower values indicate potential gas pollution. For water quality, Total Dissolved Solids (TDS) values below 600 ppm were considered acceptable, with further categorization into excellent quality (<300 ppm), good (300–600 ppm), and degraded conditions (>600 ppm), according to the WHO palatability ranges; WHO sets no health-based guideline value for TDS [31].

3.5. Software Environment The following software stack was used to operate the acquisition system, process data, and conduct downstream analysis: • Python 3.11: real-time sensor reading, data logging, and preprocessing scripts. • Adafruit CircuitPython BME680 library: I2C communication and sensor configuration. • ADS1x15 Python library: ADC interfacing for TDS analog signal acquisition. • Local CSV storage: timestamped records saved to the Raspberry Pi filesystem , with timestamps in UTC synchronised by NTP. • RealVNC Viewer: secure remote desktop access to the Raspberry Pi for monitoring and control.

5

• Google Colab (Python): cloud-based environment for data analysis, feature engineering, and ML model training, using Pandas, NumPy, Matplotlib, Scikit-learn, and TensorFlow; exact package versions are pinned in

• Candle flame (thermal anomaly): Introduced as a localized heat source to emulate thermal anomalies such as those caused by nearby equipment or solar radiation. The impact of each disturbance is reflected in the corresponding sensor channels. However, explicit event start and end times are not available in the dataset. These disturbances affect the ambient environment rather than the water itself. Consequently, they are not used as ground-truth event labels for a dedicated event-detection task.

requirements.txt in the followin repository https: //github.com/nejiamal3-oss/aquasense. 3.6. Data Acquisition Methodology Data collection spanned a 25.4-hour window (from 19 May 2025 at 12:39:08 to 20 May 2025 at 14:01:00), of which 8.0 h contain recorded samples (26% coverage). The record is interrupted by 23 gaps longer than 60 s, the longest lasting about 10.1 h. Within recorded periods, consecutive samples are most often separated by 1–2 s (median step 1 s); the mean step of 3.9 s is inflated by the gaps.This acquisition rate was chosen to enable fine-grained temporal monitoring of sensor dynamics, particularly transient pollution events, while maintaining manageable storage overhead. Each recorded sample is timestamped and contains four measurement fields: TDS, temperature, relative humidity, and gas resistance. The main acquisition statistics are summarized in Table 4.

3.8. Data Preprocessing Pipeline The released dataset keeps every raw sample in physical units together with quality flags; the steps below produce the analysis-ready version and are implemented as a script so that users may re-run or skip them. • Quality control: The raw record contains no physically impossible reading (maximum humidity 73.6%, no negative gas resistance or TDS value). The fused file keeps the observed channels after fault and attack injection, whose extreme values are identified by fault_type. • Missing values: The four sensor channels have no missing value, so no imputation is applied.

Table 4: Summary of the acquisition campaign. Metric

Value

Total acquisition window Sampling interval Number of records Missing samples (vs. a nominal 1 s step) Raw dataset size Measured parameters

25.4 hours (8.0 h recorded) 1–2 seconds (median 1 s) 23,688 samples 67,625 (74.1%) ∼2 MB (CSV format) TDS, Temp., Humidity, Gas Resistance

• Feature normalization: Normalisation is not applied to the released data. In the benchmark it is fitted on the training split only; gas resistance is log-transformed before z-scoring because of its range of more than two orders of magnitude. • Temporal windowing: The benchmark uses windows of W = 30 samples with stride 5; a window is labelled by its last sample.

Note: The 25.4-hour window (8.0,h of recorded data) is used as an initial proof-of-concept to validate the proposed cyberphysical IoT pipeline. The same deployment framework is scalable to long-term monitoring (weeks to months), which is expected to enhance temporal generalization and improve the robustness of learned models under diverse environmental conditions.

• Label generation: See Section 6.3. 4. Hydraulic and Chemical Simulation using EPANET-MSX This section presents the simulation framework used to generate synthetic hydraulic and water quality data for the cyberphysical dataset. The objective is to complement real IoT sensor measurements with physically consistent, multi-species hydraulic modeling, thereby enabling a benchmark that combines both real-world variability and controlled, reproducible simulation scenarios.

3.7. Experimental Perturbation Scenarios

To evaluate system responsiveness under dynamic and adverse conditions, three categories of controlled perturbations were introduced during the acquisition period. These disturbances were designed to emulate realistic pollution and environmental stress scenarios encountered in indoor or semi-controlled 4.1. EPANET-MSX Simulation Framework water monitoring deployments: EPANET-MSX (Multi-Species eXtension) is an open-source extension of the U.S. EPA EPANET hydraulic solver that en• Cigarette smoke (VOC/gaseous pollution): Simulates ables multi-species reactive transport modeling in pressurized indoor air quality degradation due to volatile organic comwater distribution networks (WDNs) [18, 19]. Unlike standard pounds (VOCs), resulting in sharp decreases in gas resisEPANET, which supports only single-species water-quality tracktance readings. ing, EPANET-MSX allows the simultaneous representation of • Cup of water (humidity spike): A water-filled container coupled chemical reactions involving multiple water quality species placed near the sensor to simulate evaporation-induced in both the bulk water and pipe-wall (biofilm) domains. humidity increases, emulating condensation-prone enviThe simulation framework integrates hydraulic dynamics ronments. with multi-species chemical evolution, capturing the following interacting phenomena: 6

• Chlorine (Cl) decay: first-order bulk degradation coupled with biofilm wall demand.

(.msx) files are released so the same pipeline can be applied to larger systems.

• pH variation: dynamic equilibration driven by disinfection chemistry. Component Reservoirs Junction nodes Storage tank Pipes Pump PRV valve TCV valve Total pipe length Pipe diameters Base demand

• Turbidity (TURB): evolution of suspended particle load and water clarity. • Dissolved Oxygen (DO): consumption through oxidation reactions coupled with chlorine dynamics. • Conductivity (COND): variation in ionic concentration along the distribution network.

Table 5: Hydraulic network components ID(s) Count Role R1, R2 2 Fixed-head water sources J1–J10 10 Demand / sampling points T1 1 Buffer reservoir Backbone + links 17 Distribution conduits PU1 1 R2 → pressure boost PRV-1 1 Pressure regulation TCV-1 1 Flow control – – 16.8 km – – 250–300 mm – – 59.5 L/s total

• Trihalomethane formation (THM): disinfection by-products (DBPs) formed as a chlorine-dependent reaction pathThe presence of loops and redundant flow paths enables roway, regulated under EPA/WHO drinking water standards. bust simulation of contaminant propagation under varying demand patterns, pump scheduling, and valve configurations. Junc• Wall Chlorine Demand (ClD): biofilm-induced chlorine tion nodes J1–J10 serve both as demand points and as virtual consumption on internal pipe surfaces. water quality monitoring stations. Figure 3 illustrates the simulated hydraulic network topolThe MSX configuration file defines the reaction kinetics ogy. governing each species in both bulk and wall phases, using coupled ordinary differential equations (ODEs) solved simultaneously at each time step across all network nodes and pipe segments.

R1

J1 J2 Cl injection

4.2. Hydraulic Network Topology

J10

TURB injection

J3

J7

V1 (PRV)

The simulated network (Fig. 3) represents a single pressure zone of a municipal distribution system, comparable to a disJ6 V2 (TCV) trict metered area (DMA). We model one zone rather than a full J4 city network because utilities operate, monitor, and isolate their systems at the zone level. Sensor placement, anomaly detecJ9 tion, and incident response are therefore normally carried out at J8 R2 this scale. The network has 16.8 km of pipes with diameters of PU1 J5 250–300 mm and a total base demand of 59.5 L/s (Table 5). The topology was designed to meet three requirements. (i) T1 Coverage of the attack surface: it includes every class of component whose manipulation can compromise water quality or Storage tank Junction Reservoir supply, namely two fixed-head sources (R1, R2) with different Injection node Pipe Pump source quality, a storage tank (T1), a pump (PU1), a pressurereducing valve (PRV-1), and a throttle control valve (TCV-1). PRV TCV (ii) Hydraulic diversity: looped sections produce redundant paths and flow reversals, while branched sections produce long resiFigure 3: Hydraulic network topology generated using EPANET. dence times. (iii) Interpretability: with 13 nodes, each detected anomaly can be traced to a physical propagation path, so the 4.3. Reaction Kinetics and Multi-Species Interaction Model SHAP attributions in Section 9 can be checked against known The EPANET-MSX model governs the temporal evolution hydraulic cause and effect. of each simulated species through a system of coupled reaction Networks of this scale remain standard in recent water-security equations summarised in Table 6 and written out below. Chloand water-quality studies: EPANET Net1 (9 junctions) is the main case study in recent work on stealthy cyberattacks against network hydraulics [33] and on multi-species water-quality modTable 6: Multi-species reaction kinetics summary Species Sym. Phase Kinetics elling and control validated against EPANET-MSX [34, 35], Chlorine Cl Bulk First-order bulk decay; DO coupling; ClD diagnostic while the Hanoi network (32 nodes) is used for machine-learning pH pH Bulk First-order relaxation to pHnat (= 7.4) Turbidity TURB Bulk First-order settling contamination detection [36]. Our network is of comparable Dissolved Oxygen DO Bulk First-order decay; coupled to Cl Conductivity COND Bulk First-order decay (lumped loss term) size but contains more control elements (a pump, a PRV and a Trihalomethanes THM Bulk Rate ∝ Cl TCV, two sources and a tank). The network (.inp) and reaction Wall Chlorine Demand ClD Wall Wall demand (kwall Cl), no feedback 7

rine decay is the central driver of the multi-species system: it simultaneously depletes through intrinsic bulk degradation, oxidative consumption of dissolved oxygen, and biofilm demand on pipe walls. THM formation is modeled as a secondary reaction product whose rate increases with chlorine concentration and residence time, consistent with established DBP formation models in the literature [37]. Written explicitly (all parameter values are listed in the released .msx file and in Table 8): d Cl = −kcl Cl − kcl,DO Cl DO, dt d ClD = kw Cl (wall species, pipes only), dt d THM = kthm Cl, dt d DO = −kdo DO − kcl,DO Cl DO, dt d pH = −kph (pH − pHnat ), dt d TURB = −kturb TURB, dt d COND = −kcond COND, dt

Table 8: Reaction parameters (from the .msx file) Symbol kcl kcl,DO kw kthm kdo kph pHnat kturb kcond

Meaning Bulk chlorine decay (first order) Chlorine–DO coupling coefficient Wall chlorine demand rate (biofilm, k_wall) THM formation rate (proportional to Cl) Dissolved oxygen decay pH relaxation rate Natural (equilibrium) pH Turbidity settling rate Conductivity decay rate

Value 0.10 h−1 0.005 L mg−1 h−1 0.02 m h−1 0.008 h−1 0.02 h−1 0.01 h−1 7.4 0.05 h−1 0.03 h−1

Source [38] [18] [38] [18] [18] [18] [18] [18] [18]

The resulting synthetic dataset provides complete multi-species time series at all 13 nodes, enabling both spatial analysis of contaminant propagation and temporal anomaly detection. This dataset was subsequently co-registered with real IoT measurements to construct the final cyber-physical benchmark used for machine learning model training and evaluation. Figure 4 illustrates the simulated concentration profiles of Cl, THM, DO, and Turbidity at nodes J3 and J7 following contamination injection events.

(2) (3) (4) (5) (6)

5. Data Augmentation and Cyber-Physical Perturbations

(7)

This section describes the strategies implemented to improve the robustness of the IoT dataset against two categories of challenges: the scarcity of training data and the presence of realistic cyber-physical perturbations. Four complementary axes are explored: statistical and temporal augmentation, synthetic generation through Bootstrapping and TimeGAN, cyberphysical attack modeling, and realistic sensor noise injection. All four are implemented in one seeded generator (aquasense.perturb), so any user can regenerate or extend the perturbed data. Augmented and synthetic data are released in separate files and are never mixed into validation or test splits.

(8)

where kcl , kdo , kturb , kcond , kph and kthm are first-order rate constants (h−1 ), kcl,DO is the coupling coefficient between chlorine and dissolved oxygen (L mg−1 h−1 ), and kw is the rate at which the biofilm exerts a chlorine demand on the pipe wall (m h−1 ). ClD is a diagnostic wall-demand species that does not feed back on bulk chlorine. The pH is not an algebraic equilibrium species: it is a dynamic species that relaxes at rate kph toward the natural pH, pHnat = 7.4. THM is formed in proportion to the residual chlorine, and dissolved oxygen is consumed both by its own decay and by the chlorine-coupled term. Turbidity is removed by first-order settling only (no resuspension), and conductivity decays at first order rather than being treated as a conservative tracer. The same equations, without the wall species ClD, are applied in storage tanks. The first-order bulk term follows [38].

5.1. Time-Series Augmentation Time-series augmentation consists of generating new synthetic observations from real data without altering their essential statistical structure [39, 40]. Five techniques were applied to the columns tds_value, temperature, humidity, and gas_resistance. Jittering adds Gaussian noise (σ = 0.05 in the raw units of each channel). Because this amplitude is negligible compared with the gas-sensor resistance (about 90 000 Ω), the perturbation is very weak for the gas channel; in the file, it modifies only 19 % of the gas rows.) to each value of the series, mimicking the natural micro-fluctuations of an IoT sensor. Scaling applies a random multiplicative factor within the interval [0.9,1.1] to simulate sensor gain variation. Time warping deforms the time axis through interpolation over random nodes (n_knots = 4), reproducing real sampling irregularities. Window slicing extracts a 90% sub-window of the series at a random position, then fills missing values with NaN, simulating partial collection interruptions. Finally, Permutation divides the series into 4 segments and randomly shuffles them, disturbing the temporal order while preserving the overall value distribution.

4.4. Simulation Parameters and Output Dataset As summarized in Table 7, the EPANET-MSX simulation covers 24 hours with a 1-hour hydraulic step, a 5-minute water quality step and hourly reporting. The demand follows pattern P1, and the water quality state is initialized from reservoirs R1 and R2, with default initial values assigned to all other nodes. Contamination is represented by two pulse injections (chlorine at J3 and turbidity at J7, each lasting two hours) and by localized initial perturbations at J2, J5 and J9. The simulation is exported as 24 hourly states (t = 1 to 24 h) of six species at 13 nodes (78 variables).

8

Parameter Simulation duration Hydraulic time step Water quality time step Reporting interval Demand pattern Spin-up discarded Source quality (R1, R2) Default initial quality (other nodes) Contamination scenarios Output format Total synthetic records

Table 7: EPANET-MSX simulation configuration Value 24 hours 1h 5 minutes (MSX TIMESTEP = 300 s) 1h P1: 12 hourly multipliers (12-hour cycle, repeated twice over 24 h) None (no warm-up period; full 24 h retained) Cl 1.0/0.8 mg/L, pH 7.4, DO 9.0/8.0 mg/L, COND 380 µS/cm, TURB 0.5 NTU, THM 0 Cl 0.5 mg/L, pH 7.4, DO 8.0 mg/L, COND 380 µS/cm, TURB 0.5 NTU, THM 0 Pulse injections (SETPOINT): J3 chlorine 5.0 mg/L, active 06:00–08:00 (2 h); J7 turbidity 10 NTU, active 14:00–16:00 (2 h) One wide CSV (24 rows × 78 variables, plus a time column) 24 hourly states × 78 variables (1 872 values)

Figure 4: Simulated concentration profiles of Cl, THM, dissolved oxygen and turbidity at nodes J3 and J7, and at the downstream node J8, following the contamination injection events. Shaded bands mark the injection windows as observed in the hourly report: chlorine at J3 (07:00–08:00, 5.0 mg/L) and turbidity at J7 (15:00–16:00, 10 NTU). Background values remain physical (pH = 7.4). The THM response is small (order 10−2 µg/L) and appears mainly downstream of J3, at J8.

Why augmented series are not stored as extra columns: In the first version the five variants were appended as 20 columns aligned row-by-row with the original signals. This creates two problems: (i) a jittered or scaled copy of a feature is almost identical to the feature, so any label computed from the feature can be read off the copy; and (ii) permuted, warped and sliced copies are misaligned in time with the row they sit on, so they describe a different moment than the label. Augmentation is therefore now released as separate sequence files that users apply to training data only.

5.2.1. Bootstrapping Bootstrapping is a controlled statistical generation method consisting of resampling existing data with replacement to create new observations. Applied to the IoT time series, we use a standard i.i.d. bootstrap in which individual samples are drawn uniformly with replacement until the dataset size is doubled (resampling factor of 2). This procedure does not preserve the temporal order or the short-range autocorrelation of the original series. It allows reuse of existing data while adding small variations to the tds_value feature through Gaussian noise (µ = 0, σ = 0.2, in raw units) and simulating a slow upward trend through a linear drift increasing from 0 to 1 over the length of the synthetic series. The synthetic set is then concatenated with the original data. This approach represents the baseline level of synthetic generation: simple to implement, fast to execute, and producing directly usable results.

5.2. Synthetic Generation: Bootstrapping and TimeGAN In addition to direct augmentation, two synthetic generation methods were used to further enrich the volume and diversity of the dataset. 9

Table 9: Time-series augmentation techniques

Technique

Parameters

Simulated Effect

Output file

Jittering Scaling Time warping Window slicing Permutation

σ = 0.05 (raw units of each channel) factor ∈ [0.9, 1.1] n_knots = 4 ratio = 0.9 n_segments = 4

Sensor micro-fluctuations Gain variation Sampling irregularities Random subsequences + NaN Temporal order shuffling

augmented_data.csv augmented_data.csv augmented_data.csv augmented_data.csv augmented_data.csv

Formal definition. Let xt ∈ R be a clean channel, σ x its standard deviation on the training split, and A = [t s , t s + L) an attack interval. The attacked signal x̃t equals xt outside A and, for t ∈ A:

Fidelity evaluation: The qualitative comparison above is replaced by the three standard TimeGAN metrics [41], computed on held-out real data (Table 10): the discriminative score (|0.5− accuracy| of a post-hoc classifier separating real from synthetic; lower is better), the predictive score (MAE of a one-step forecaster trained on synthetic and tested on real, TSTR; lower is better), and a PCA/t-SNE overlay (Fig. 5). The simple bootstrap obtains a lower discriminative score than TimeGAN (0.037 vs. 0.172).

FDI (bias): FDI (stealthy): Replay:

Table 10: Fidelity of synthetic sequences (mean ± std over 5 runs). Real data (reference) Bootstrap TimeGAN

Discriminative score ↓

Predictive score (MAE) ↓

– 0.037 ± 0.031 0.172 ± 0.047

0.028 ± 0.000 0.028 ± 0.000 0.029 ± 0.000

β ∼ U{±[0.5, 2]},
x̃t = clip xt + β σ x , ℓ, u , x̃t = xt−∆ ,

(9) (10)

∆ ≥ L, [t s −∆, t s −∆+L) attack-free, (11)

DoS:

x̃t = xts −1 (frozen)

Drift:

x̃t = xt + γ σ x

t − ts , L

or

x̃t = NaN (dropped), (12) γ ∼ U[1, 3],

(13)

where [ℓ, u] is the normal operating range of the attacked channel. Onsets t s are drawn uniformly and intervals never overlap. The released stream contains 14 attack segments (replay 7, drift 3, DoS 2, FDI 1, stealthy FDI 1) of 52 to 287 samples each, and 10.0% of the real samples are attacked. Each attack type acts on specific channels (Table 11): FDI on Cl_J7, stealthy FDI on TURB_J7 and DoS on TURB_J3, so these three types never alter a real sensor channel, whereas replay and drift act on real and simulated channels. Both DoS variants are implemented: one interval is frozen (last valid value repeated) and one is dropped (NaN, 271 samples on TURB_J3). Each sample carries attack_type ∈ {none, FDI, FDI-stealth, replay, DoS, drift}, attack_id and attack_channel. The earlier zeroforcing DoS was dropped because a real DoS produces missing or stale packets, not zeros, and zeros are trivially detectable.

Figure 5: PCA (a) and t-SNE (b) overlay of real held-out sequences, bootstrap sequences and TimeGAN sequences (500 windows of length 24 each).

Generator

x̃t = xt + β σ x ,

5.3. Cyber-Physical Attack Modeling Five attack types (four classes, including a stealthy variant of false data injection) are simulated, representing the most frequent attack vectors in industrial IoT environments. These attacks are directly injected into time series to create labeled samples for training detection models. False Data Injection (FDI) modifies transmitted values without affecting the underlying physical system, making falsification invisible to conventional threshold-based alarms [11]. The Replay attack reinjects a past data window to hide an abnormal current state, giving the monitoring system the illusion of normal operation. Denial of Service (DoS) simulates a silent sensor by interrupting delivery of measurements. Progressive Drift introduces a growing error, making it particularly difficult to detect without long historical reference, since no fixed threshold can intercept it. 10

Table 11: Attack and fault types in the real stream: number of segments, length and channels affected (number of samples). Type

Segments (length)

Channels (samples)

FDI FDI-stealth DoS Replay

1 (102) 1 (265) 2 (244–271) 7 (52–287)

Drift

3 (54–196)

Cl_J7 (102) TURB_J7 (265) TURB_J3 (515) humidity (287), TURB_J7 (201), TURB_J3 (169), gas (159), TDS (143), temp. (85) TDS (388), humidity (54)

White noise Spike

2,368 samples 118 samples

Extreme

47 samples

all channels simultaneously temp. (22), gas (18), humidity (15), Cl_J7 (14), TURB_J3 (14), TDS (12), TURB_J7 (12), Cl_J3 (11) temp. (8), TURB_J3 (8), Cl_J3 (7), Cl_J7 (7), TURB_J7 (5), gas (5), TDS (5), humidity (2)

The attacks remain close to the normal range of the observed channels. FDI samples on Cl_J7 lie between 0.393 and 0.480 mg/L (mean 0.437), against a clean maximum of 0.476; stealthy FDI and replay samples on TURB_J7 lie between 0.417 and 0.737 NTU, inside the clean range (0.350–0.821); DoS and replay samples on TURB_J3 lie between 0.252 and 0.549 NTU (clean range 0.203–0.606). The frozen DoS values never produce a zero reading. 5.4. Realistic Noise and Anomalies Three types of perturbations are injected to simulate faulty behaviors of physical sensors under real operating conditions. These perturbations are distinct from intentional attacks: they reproduce unintentional failures linked to environmental conditions, hardware wear, or electronic interference, and they carry a separate label (fault_type) so that models can be tested on the practically important question of distinguishing faults from attacks. White noise (N(0, 0.22 ), in standardized z-score units) models small, zero-mean Gaussian fluctuations commonly observed in IoT sensor measurements. This perturbation is added to legitimate measurements to evaluate the model’s robustness to random measurement variability without incorrectly identifying minor fluctuations as significant anomalies. Spikes are generated by adding isolated high-amplitude impulses (+5σ x ) at randomly selected time indices, simulating transient sensor glitches or erroneous readings potentially caused by electromagnetic interference or acquisition errors. Extreme values are generated by replacing selected measurements with the corresponding sensor’s full-scale limit, simulating saturation or temporary sensor malfunctions. Gaussian white noise is independently injected into all sensor channels, whereas spikes and extreme-value perturbations are introduced into one channel at a time to assess the model’s sensitivity to localized anomalies. These three combined types cover common real IoT sensor failures, from normal micro-variations to complete faults. 5.5. Section Summary

reliable fusion, a common temporal key expressed in the same unit is required. Alignment. Both sources are indexed by elapsed seconds since the start of their record, τ. The real record runs from 202505-19 12:39:08 to 2025-05-20 14:01:00, i.e. about 25.4 h, and contains 23,688 samples (median step 1 s, mean step 3.9 s); it is not continuous, since 23 gaps longer than 60 s interrupt it, the longest lasting about 10.1 h. The simulation file covers 24 h (time_h from 1.00 to 24.00 h, one state per hour), so no spinup period is discarded. The start of the real record is aligned with the start of the simulation clock: τsim = τreal + ∆0 ,

∆0 = 0 s.

(14)

6.1.2. Processing of Real Sensor Data The timestamp field in the real dataset follows the ISO 8601 datetime format (e.g., 2025-05-19 12:39:08). It is converted as follows: τreal = t − t0 [s],

t0 = first timestamp

(15)

Rows containing invalid or missing timestamps are removed using dropna() before conversion, ensuring the integrity of the temporal join key. 6.1.3. Processing of Simulated Data The EPANET-MSX export (simulated_data.csv) is already in wide format: one row per hourly reporting step (24 rows) and one column per species and node (6 species × 13 nodes = 78 columns, e.g. Cl_J3). Time is stored as a numeric column time_h (elapsed hours, from 1.00 to 24.00 h). The preprocessing steps are: • Removing rows with a missing time_h; • Converting hours to elapsed seconds: τsim = round(3600 time_h) [s]

(16)

• Applying the clock offset ∆0 = 0 defined above; no spinup rows are discarded since the file covers only 24 h. If a simulation file is delivered in long format (Time as HH:MM, one row per node), the pipeline also supports it: τsim = 3600 Hour+ 60 Minute, followed by a pivot to wide format.

All strategies deployed in this section form a coherent and complete dataset robustness pipeline structured over four increasing levels of complexity.

6.1.4. Time Format Correspondence 6. Temporal Fusion and Water Quality Labeling Table 15: Temporal format correspondence across data sources

This section presents the final construction of the supervised dataset used for training classification models. It includes temporal alignment of heterogeneous data sources, a fusion strategy, and an automatic water quality labeling procedure based on standardized physicochemical indicators. 6.1. Temporal Alignment

Source

Original Format

Temporal Key

Real_data.csv simulated_data.csv Merged dataset

ISO 8601 timestamp time_h (numeric hours) Integer (tau_s)

elapsed s, τreal round(3600 time_h) Common join key

6.2. Data Fusion Strategy 6.2.1. Join Selection Each real sample is matched with at most one simulated network state through an as-of join with a tolerance of one reporting interval (3,600 s):

6.1.1. Context and Objective The two data sources, real physical sensors and hydraulic simulation outputs, use heterogeneous time formats. To enable 11

Table 12: Cyber-physical attack scenarios

Attack Type

Parameters

Observable Effect

Detection Difficulty

False Data Injection FDI (stealthy) Replay Denial of Service Drift

β ∈ ±[0.5, 2] σ x as FDI, clipped to [ℓ, u] ∆≥L frozen or dropped γ ∈ [1, 3] σ x over L

Step offset In-range offset Plausible but stale values Flat line or missing samples Slowly growing bias

High Very high Moderate Low Very high

Table 13: Realistic sensor noise and anomaly scenarios

Noise Type

Parameters

Frequency

Detection Difficulty

White noise Spike / Impulse Extreme values

N(0, 0.2σ x ), 10.0% of samples (2,368) +5σ x , 0.5% of samples (118) full-scale value, 0.2% of samples (47)

Very frequent Occasional Rare but critical

Low Moderate High

is shared by at most 2,816 consecutive samples. As a consequence, the chlorine pulse at J3 (state at τ = 7 h, matched by 1,427 samples) is present in the fused table, whereas the turbidity pulse at J7 (states at τ = 15 and 16 h) is not matched by any real sample and remains visible only in simulated_data.csv. Elapsed time τ is counted from the start of each record, so τ = 7 h corresponds to about 19:39 on 19 May in the real record, not to 07:00 clock time. No value is invented and no value crosses a node boundary. The approach assumes quasistationary behavior of the network over one hour.

df = pd.merge_asof(real.sort_values("tau_s"), sim_wide.sort_values("tau_s"), on="tau_s", direction="backward", tolerance=3600) Simulated columns whose name already exists in the fused table (Cl_J3, TURB_J3, Cl_J7, TURB_J7) are renamed with the suffix _epanet. The column sim_state_h records the hour of the simulated state matched to each real sample. The fused table has exactly one row per real sample (23,688 rows), with no duplication. Observed Cl and TURB channels. The columns Cl_J3, TURB_J3, Cl_J7 and TURB_J7 are the channels on which the attack and fault generator acts. They are noisy signals around constant baselines and are distinct from the hourly EPANET outputs (*_epanet). On the 18,787 real samples without attack or fault, their mean (standard deviation) is 0.500 (0.042) for Cl_J3 and 0.349 (0.042) for Cl_J7 (mg/L), and 0.401 (0.067) for TURB_J3 and 0.599 (0.083) for TURB_J7 (NTU). Over all real samples, fault injection widens these ranges to 0–5 mg/L and 0–1000 NTU: 27 extreme samples set one of these channels to zero (11 samples) or to its full-scale value (16 samples).

6.2.3. Synthetic Sequences The TimeGAN sequences have no common clock and no associated simulated state. The 23,688 synthetic rows are appended to the fused table with origin = timegan, attack_type = fault_type = none, and missing values (NaN) for columns not provided by TimeGAN. Only tds_value, temperature, humidity, and gas_resistance are shared with the real data. These synthetic sequences are used for training only. The resulting file contains 47,376 rows and 97 columns, of which 23,688 have origin = real. The TimeGAN rows carry the four sensor channels only; their labels quality_final and wq_class are missing, and attack_type and fault_type are none.

6.2.2. Temporal Propagation Simulated data are produced every hour, whereas real sensors provide measurements every 1–2 s (median step 1 s). The backward as-of join assigns to each real sample the most recent simulated state within 3,600 s, the EPANET-MSX reporting resolution. Applied to the 23,688 real samples, the join gives a simulated state to 20,795 samples (87.8%). The remaining 2,893 samples keep missing values (NaN) for the simulated columns: 1,800 samples recorded during the first hour, before the first simulated state at τ = 1 h, and 1,093 samples recorded more than one hour after the last state (the real record lasts 25.4 h, the simulation 24 h). Because the real record is interrupted by long gaps (Section 3), only 11 of the 24 hourly states are matched by at least one real sample, and a single state

6.2.4. Post-Fusion Cleaning • Removed columns: Time, Hour, Minute, time_h, tau_s, tau_real, quality_score and the twenty augmented copies of the sensor channels (released separately in augmented_data.csv); • Preserved column: timestamp; • Metadata columns origin, attack_id, attack_channel, fault_channel, sim_state_h; • Labels: attack_type, fault_type, wq_score, wq_class and, as last column, the legacy label quality_final. 12

Table 14: Comprehensive summary of data augmentation and cyber-physical perturbation strategies

Axis

Methods used

Output

Objective

Temporal augmentation

Jittering, scaling, time warping, window slicing, permutation

5 separate training-only files

Diversify the training dataset

Synthetic generation

Bootstrapping, TimeGAN

Realistic synthetic series (separate files, fidelity in Table 10)

Cover rare scenarios and increase volume

Cyber-physical attacks

FDI, stealthy FDI, replay, DoS, drift

5 labeled attack types, sample-level labels

Train intrusion detection models

Realistic sensor noise

White noise, spikes, extreme values

3 perturbation types (fault_type)

Simulate unintentional sensor failures

In the final file, attack_type contains five attack classes points. Table 16 summarizes the selected thresholds and their (replay: 1,044; DoS: 515; drift: 442; FDI-stealth: 265; FDI: reference standards. 102), representing 10.0 % of the 23,688 real samples. The colAt node J3 the simulated indicators take the values reported umn fault_type contains three fault classes (white noise: 2,368; in Table 19: pH 7.4, turbidity 0.46–0.48 NTU, THM below spike: 118; extreme: 47), representing 10.7 % of the real sam0.01 µg/L, conductivity 363–370 µS/cm, and chlorine between ples. The dataset comprises 23,688 real rows and 23,688 TimeGAN-0.60 and 5.00 mg/L. The TDS indicator is computed on the raw generated rows. record, before fault injection. On the 23,688 real rows, tds_value has a median of 0.362 6.3. Automatic Water Quality Label Generation and a mean of 0.536, with values from 0.007 to 1.196 and no negative value. These values do not appear to be expressed in Label families. The released table provides (i) wq_score and ppm (no voltage column is released, so the conversion cannot be wq_class, computed only from water parameters with fixed verified), and the ppm thresholds of Table 16 cannot be meanregulatory thresholds: pH, turbidity, residual chlorine, THM ingfully applied to them: since every value is below 300, the and conductivity at node J3 from the simulation, and TDS from TDS indicator always receives the maximum score of 2 points the raw sensor record; (ii) attack_type and fault_type, and does not discriminate between samples. The simulated from the perturbation generator (Section 5); and (iii) quality_final, variables follow the units declared in the MSX file: THM in a legacy label inherited from the first version of the dataset, deµg/L, turbidity in NTU, residual chlorine and dissolved oxygen rived from nine inputs that include ambient variables (air temin mg/L, and conductivity in µS/cm. perature, humidity, gas resistance). Air humidity and VOC level do not describe the water, so quality_final is kept for back6.3.3. Class Assignment with Fixed Thresholds ward compatibility only and is not used as a benchmark target. Classes are assigned with fixed rules, including a healthbased override (Table 17). Applied to the 20,795 real sam6.3.1. Composite Scoring Approach ples that have a simulated state, with the TDS indicator comAutomatic labeling is based on a composite score computed puted before fault injection, the rules give 20,795 “Very Good” from six physicochemical indicators. Each parameter is evalusamples and no “Good” or “Poor” sample: the score equals ated using two thresholds: 11 for every sample. Three reasons explain this. The simulated J3 values stay within regulatory limits (pH 7.4, turbid• 2 points: fully compliant ity 0.46–0.48 NTU, THM below 0.009 µg/L, conductivity 363– • 1 point: acceptable 370 µS/cm). The TDS values (maximum 1.196) always receive the maximum score. And chlorine (0.60–5.00 mg/L) never falls • 0 point: non-compliant in the optimal range of 0.20–0.50 mg/L, hence a score of 11 rather than 12, while the chlorine pulse reaches exactly 5.0 mg/L The total score ranges from 0 to 12 points (the maximum in 1,427 samples without exceeding the critical threshold of reached in the dataset is 11). > 5 mg/L. The remaining 2,893 real samples have no simulated state and receive no class. We consequently do not use 6.3.2. Indicators and Thresholds wq_class as a benchmark target. The composite quality score is derived from six physicochemical indicators evaluated at a single reference node of the network (J3). For each parameter, two evaluation levels are defined: an optimal range corresponding to full compliance (2 points) and an acceptable range corresponding to partial compliance (1 point), while values outside these limits receive 0 13

Table 16: Water quality indicators and scoring thresholds

Parameter

Optimal Range

Acceptable Range

Score

Reference

pH Turbidity (NTU) Residual Chlorine (mg/L) Trihalomethanes (µg/L) Conductivity (µS/cm) TDS (mg/L)

6.5–8.5 ≤1 0.2–0.5 ≤ 60 ≤ 800 ≤ 300

6.0–9.0 ≤5 0.1–5.0 ≤ 100 ≤ 2500 ≤ 600

2/1/0 2/1/0 2/1/0 2/1/0 2/1/0 2/1/0

[31, 42] [31] [31] [42] [42] [31]

• Targets: attack_type, fault_type, wq_class (constant, see above) and the legacy quality_final;

Two features of the real stream deserve attention. First, the mean air temperature (30.75 ◦ C) lies above the normal range of Table 3 (10–30 ◦ C), and 62% of the real samples fall outside it; the temperature-based ambient flag is therefore active for most of the record and should be read as a station-specific offset rather than as an anomaly. Second, gas resistance falls below 8,000 Ω in 818 samples (3.5%), grouped in 38 short episodes concentrated in five sessions of the record, with a minimum of 670 Ω. The simulated variables are complete (no missing value) and vary over the 24 h horizon. Chlorine shows the largest variation, driven by the injected pulse, whereas pH remains at its natural value of 7.4, and turbidity, dissolved oxygen, THM and conductivity vary only slightly at J3, since the turbidity pulse is applied at J7 and not at J3.

• 47,376 rows: 23,688 real and 23,688 TimeGAN rows;

6.6. Distribution of Target Classes

Table 17: Final water quality classes Class

Condition

Interpretation

Very Good Good Poor

S ≥ 11 and no critical violation 8 ≤ S < 11 and no critical violation S < 8 or any critical violation∗

High-quality compliant water Acceptable water quality Potential health risk

∗

Cl < 0.1 or > 5 mg/L, TURB > 5 NTU, or THM > 100 µg/L.

6.3.4. Final Dataset Structure The final dataset contains: • Input features: the four sensor channels, the four observed Cl/TURB channels and the 78 simulated variables;

Table 20 reports the water-quality class wq_class of the real rows. The TimeGAN rows carry no simulated state and no class. The legacy label quality_final (real rows: 1,578 Very Good, 5,154 Good, 16,956 Poor) is unrelated to wq_class: 6.4. Structure of the Dataset among the 20,795 real samples with a simulated state, it is Poor The release is organised as linked tables rather than one for 14,970 (72.0%), Good for 4,441 (21.4%) and Very Good for wide file (Table 18); the measured tables are indexed by timestamp 1,384 (6.7%), whereas wq_class is Very Good for all of them. and the simulated table by elapsed time time_h. • Missing values: the simulated variables are missing for the 2,893 real samples without a matched state and for all TimeGAN rows.

6.5. Descriptive Statistics per Variable 7. Exploratory Data Analysis Table 19 summarizes the descriptive statistics of the four 7.1. Correlation Analysis IoT sensor variables, computed on the 23,688 real rows of Real_data.csv, The Spearman rank-correlation matrix computed over the and of six water-quality variables at node J3, computed on the main physicochemical parameters reveals six associations (|ρ| > 24 hourly states of simulated_data.csv. The TimeGAN 0.40), all of them among simulated species. Simulated quanrows of the fused dataset are excluded, since they are generated tities are summarised by their time-averaged value at each of and not measured. the 13 network nodes (J1–J10, R1, R2, T1) over the 24 hourly On the real rows, the four sensor channels contain no missstates, since their temporal variation within a node is not neging value and no physically impossible reading: relative huligible (mean standard deviation per node: 0.24 mg/L for chlomidity never exceeds 100% (maximum 73.6%), and no gas rerine, 0.52 NTU for turbidity, 5.5 µS/cm for conductivity); 95% sistance or TDS value is negative. The sensor columns of the confidence intervals are obtained by node-level bootstrap (5000 fused table are the observed channels after fault and attack inresamples). Sensor channels are correlated on the 18,787 real jection; rows without fault or attack are identical to the raw rows that carry neither an attack nor a fault, so that injected perrecord. The extreme values found in them are injected faults turbations do not affect the coefficients. We report effect sizes flagged by fault_type: eight full-scale temperature values ◦ and intervals rather than p-values. Augmented variants are not (−40 or 85 C) and three TDS values of 1000 (extreme), one part of the released table and are excluded. The significant pairs humidity above 100% (spike), and 37 negative gas resistances are summarised in Table 21. produced by white noise added to low readings. 14

Table 18: Structure of the released dataset (v1.0). File

Rows

Cols

Real_data.csv

23,688

6

simulated_data.csv

24

79

augmented_data.csv

23,688

27

synthetic_data.csv

23,688

4

fused_dataset.csv

47,376

97

network/water_network.inp

–

–

network/water_quality.msx

–

–

network/injection_schedule.csv – splits.json –

– –

Content timestamp, temperature (◦ C), humidity (%), gas resistance, tds_value and qualite or quality_final: indicate the real 6th column. time_h (hourly, 24 h), followed by 78 water-quality variables (Cl, pH, TURB, DO, COND, and THM) across 13 nodes in wide format. Measured sensor data with qualite, and five augmented variants of each of the four sensor channels. Synthetic sensor channels: tds_value, temperature, humidity, and gas_resistance. Fused real and synthetic data, including sensor and simulated waterquality variables, metadata (origin, attack_id, attack_channel, fault_channel), attack_type, fault_type, sim_state_h, wq_score, wq_class, and quality_final. The augmented copies are not included. EPANET hydraulic network model with 10 junctions, 2 reservoirs, 1 tank, 17 pipes, 1 pump, 2 valves, and 4 water-quality sources. The model uses a 24-hour simulation duration, hourly hydraulic and quality timesteps, and L/s flow units. EPANET-MSX multi-species model defining six bulk water-quality species (Cl, pH, TURB, DO, COND, and THM), one wall species (ClD), reaction coefficients and terms, initial/global quality conditions, and two configured setpoint sources associated with attack patterns at J3 and J7. Injection schedule. Train/validation/test indices for each task and split protocol.

Scope and limits. (i) pH is constant across nodes (7.4) and is excluded. (ii) Correlations between real and simulated channels are not computed: they are co-registered, not coupled (Section 6). (iii) No sensor pair reaches the threshold; the strongest, humidity ↔ temperature, is only ρ = +0.29, followed by tds_value ↔ temperature (−0.13) and gas_resistance ↔ temperature (−0.12). (iv) With n = 13 nodes, the coefficients describe the spatial structure of the simulated network, not independent samples. Figure 6 presents the lower-triangular heatmap of the Spearman correlation matrix rendered with the coolwarm diverging palette: warm red tones indicate strong positive associations, cool blue tones indicate negative ones, and white cells near zero denote the absence of monotone dependence.

Table 19: Descriptive statistics of selected variables. Sensor statistics are computed on the 23,688 real rows; simulated statistics on the 24 hourly states at node J3. Variable

Min

Max

Mean

Std. Missing (%)

IoT Sensors (real rows, n = 23,688) Air temperature (◦ C)a Relative humidity (%RH)a Gas resistance (Ω)a TDS (unit unverified)b

25.30 37.32 30.75 2.22 35.07 73.60 47.98 7.30 670.00 226,884.00 95,227.08 43,108.05 0.01 1.20 0.54 0.40

0.00 0.00 0.00 0.00

Water Distribution Network, node J3 (EPANET-MSX, n = 24) pH 7.40 Turbidity (NTU)c 0.46 Residual chlorine (mg/L)c,d 0.60 Dissolved oxygen (mg/L)c 7.72 Trihalomethanes (µg/L)c 0.0043 Conductivity (µS/cm)c 362.91

7.40 0.48 5.00 7.92 0.0088 370.12

7.40 0.47 1.02 7.75 0.0081 364.40

0.00 0.01 1.23 0.05 0.0010 1.63

0.00 0.00 0.00 0.00 0.00 0.00

a Temperature is recorded in ◦ C, relative humidity in %RH and gas resistance in Ω

by the BME680. These are ambient (air) measurements. b The TDS values are not in ppm (see Section 3.3); the unit is left unspecified because the raw probe voltage was not retained. c Units follow the MSX species declarations: turbidity in NTU, residual chlorine and dissolved oxygen in mg/L, conductivity in µS/cm and trihalomethanes in µg/L. d The maximum of 5.00 mg/L corresponds to the chlorine pulse injected at J3 (reported at 07:00 and 08:00). The wall species ClD is internal to the MSX model and is not reported.

Table 20: Distribution of wq_class on the real rows.

Class

Samples

Share (%)

Very Good Good Poor No simulated state

20,795 0 0 2,893

87.8 0.0 0.0 12.2

Total

23,688

100.0

15

Table 21: Significant Spearman correlations (|ρ| > 0.40) among the simulated species (time-averaged value at each of the n = 13 nodes; bootstrap 95% intervals in table_spearman.csv). green = very strong (|ρ| ≥ 0.90), blue = moderate (0.40 ≤ |ρ| < 0.60).

Variable pair

ρ

Interpretation

Dissolved_Oxygen ↔ THM

−0.985

Opposite variation across nodes.

Conductivity ↔ THM

−0.983

Opposite variation across nodes.

Dissolved_Oxygen ↔ Conductivity

+0.979

Joint variation across nodes; no causal link implied.

Turbidity ↔ Conductivity

+0.456

Moderate joint variation.

Chlorine ↔ THM

−0.437

Expected sign (chlorine consumed, by-products formed), but only moderate.

Chlorine ↔ Conductivity

+0.409

Moderate joint variation.

channels of the real rows. At least one of the four sensor channels differs from the raw record in 3,568 samples (15.1%); rows without attack or fault are identical to the raw record. White noise (2,368 samples) alters all four channels at once, replay (674 samples) and drift (439 samples) alter the sensor channels listed in Table 11, and 67 spike and 20 extreme samples hit a sensor channel (the other 51 spikes and 27 extreme values act on the Cl/TURB channels). Table 22 gives the breakdown per channel. Table 22: Real samples whose sensor channel differs from the raw record. Channel

Samples (%) White noise Replay/drift Spike/extreme Max. deviation

Temperature (◦ C) Humidity (%) Gas resistance (Ω) TDS

2,482 (10.5) 2,725 (11.5) 2,549 (10.8) 2,914 (12.3)

2,367 2,368 2,367 2,368

85 340 159 529

30 17 23 17

76.4 59.7 483,643 999.9

The largest deviations are full-scale faults (for example 483,643 Ω for gas resistance and 999.9 for TDS).

Figure 6: Spearman correlation heatmap (coolwarm palette, [−1, 1] scale) for the main physicochemical parameters: four sensor channels (upper-left block, n = 18,787 real rows without attack or fault) and the simulated species (lowerright block, n = 13 nodes, time-averaged values). Real–simulated cells are masked and pH is empty (constant across nodes). Only the lower triangle is displayed to avoid redundancy; cell values are rounded to two decimal places.

8. Machine Learning Model Benchmark This section first reports the experiment run on the first release of the dataset, then shows why its scores cannot be read as evidence of dataset quality, and finally defines and runs the leakage-aware benchmark. Code for all tasks is in the repository (benchmark/).

All six associations belong to the simulated block. With n = 13 nodes they describe the spatial structure of the network and not independent observations; the three strongest involve dissolved oxygen, conductivity and THM (|ρ| ≥ 0.98), which vary together across nodes. The expected negative relation between chlorine and THM holds in sign but is moderate: Spearman ρ(Cl, THM) = −0.44 (95% bootstrap CI [−0.97, 0.17], n = 13 nodes). The interval includes zero, so the relation is not established at this sample size. The sensor channels show only weak monotone dependence (|ρ| ≤ 0.29).

8.1. Audit of the First Release: Experimental Protocol The experiment below was run on the first release of the dataset, which contained twenty augmented copies of the sensor channels; the released version no longer includes them. The benchmarking of classification models is conducted under a standardized experimental protocol. The adopted protocol is defined as follows:

7.2. Effect of Attacks and Faults on the Sensor Channels

• Data splitting: The dataset (47,376 rows) is divided into 80% training and 20% testing using stratified random sampling based on the target variable quality to preserve class distribution.

Because the water-quality label is constant (Section 6.3), class-conditional distributions carry no information. We instead measure how fault and attack injection modifies the sensor 16

• Data preprocessing:

Table 23: Performance comparison of machine learning models on the first release (47,376 rows) under the v1 protocol (random split, legacy label, all 28 input columns). These scores measure label reconstruction, not generalisation.

– Categorical variables are encoded using Label Encoding. – The qualite column is empty on 23,688 of 47,376 rows; these rows are completed from quality_final (the two columns agree on every row where both exist). No other imputation is needed. – Numerical features are standardized using Z-score normalization (StandardScaler), fitted only on the training set to avoid data leakage.

Model Random Forest XGBoost K-NN MLP SVM (RBF) Logistic Regression

Accuracy 0.9966 0.9949 0.9878 0.9869 0.9702 0.8562

F1-score (macro) 0.9939 0.9910 0.9831 0.9757 0.9576 0.7991

Precision 0.9962 0.9921 0.9834 0.9821 0.9575 0.8294

Recall 0.9916 0.9900 0.9827 0.9696 0.9579 0.7813

8.4. Analysis of Results

Why these scores are not evidence of dataset quality. Four • Cross-validation: Stratified 10-fold cross-validation (Strat- sources of leakage make near-perfect scores inevitable under ifiedKFold, k = 10) is applied on the training set to ensure the v1 protocol: model stability and support hyperparameter tuning when 1. Label is a function of the inputs. The legacy label is a required. threshold rule over eight columns (tds_value, temperature, • Evaluation metrics: gas_resistance, humidity, Cl_J7, Cl_J3, TURB_J3, TURB_J7) that are themselves inputs; a decision tree trained – Accuracy on these eight columns alone recovers the label with 0.9947 – Macro F1-score (primary metric) accuracy. Axis-aligned trees recover threshold rules almost exactly (RF and XGBoost both above 0.99 macro– Precision F1), whereas logistic regression, which cannot represent – Recall step functions, falls to 0.80. The ranking therefore reflects each model’s ability to express thresholds, not “the • Reproducibility: All models use a fixed random seed non-linear nature of the problem”. (random_state = 42). 2. Near-duplicate features. Twenty of the 28 inputs are jittered, scaled, warped, sliced and permuted copies of four 8.2. Evaluated Models of the label-defining columns (tds_value, temperature, Six machine learning algorithms from different families were humidity, gas_resistance). implemented and evaluated under identical conditions: 3. Temporal leakage. At 1–2 s sampling, consecutive samples are almost identical; a random split places neigh• Random Forest (RF): Ensemble of 200 decision trees bours of each test sample in the training set, so KNN using the Gini impurity criterion. with k = 5 effectively looks up the answer [29] (0.983 • XGBoost: Gradient boosting model with L1/L2 regularmacro-F1). ization and early stopping. 4. Label as feature. label_attack was among the inputs of the original run (Table 29, rank 8). The fused table • Support Vector Machine (SVM): RBF kernel with opcontains no duplicated rows (0 of 47,376), so row duplitimized C and gamma parameters. cation across splits is not a source of leakage here. • Multilayer Perceptron (MLP): Neural network with two Table 24 removes these sources one at a time. Removing the hidden layers of 128 neurons, ReLU activation, and Adam 20 augmented columns barely changes the score (0.9961 to optimizer. 0.9870), because the eight label-defining columns remain. Removing those eight as well leaves no sensor input: the 28 inputs • Logistic Regression: Multinomial linear model with L2 are exactly the eight label-defining columns and their 20 augregularization. mented copies, and the remaining numeric columns of the ta• K-Nearest Neighbors (KNN): Classification using k = ble (an attack identifier and a prediction-confidence score) are 5 with Euclidean distance. outputs rather than measurements, so they are not admissible inputs. The last two rows are therefore undefined for the legacy 8.3. Comparative Results label, which cannot be predicted from any column that is not itself part of its definition. This is the reason the leakage-aware The performance results obtained on the test set are sumbenchmark below moves to tasks whose labels are not derived marized in Table 23. from the inputs. On the current release (real rows only, eight columns), the same Random Forest reaches 0.976 macro-F1 under a random split but 0.341 under a chronological split, which shows that most of the apparent performance does not survive a chronological split. 17

8.7. Leakage-Aware Benchmark: Results

Table 24: Leakage ablation on the first release (47,376 rows), Random Forest, macro-F1 (mean ± std, 5 seeds). “–”: no input column remains, so the score would only reflect the majority class. The last two rows use the current release (23,688 real rows, eight observed channels as inputs, legacy label; random split: 5 seeds; chronological split: single run, seed 42). Protocol

Table 27: T4 synthetic-data utility on T3 (Random Forest, macro-F1; mean ± std over 5 seeds). The test split contains two classes (normal, replay); a constant “normal” predictor scores 0.465.

Macro-F1

v1: random split, all 28 columns, legacy label − duplicated rows removed (0 found) − 20 augmented columns removed − 8 label-defining columns removed random → chronological split

0.9961 ± 0.0005 0.9961 ± 0.0005 0.9870 ± 0.0007 – –

Current release, real rows, 8 columns, random split Current release, real rows, 8 columns, chronological split

0.9756 ± 0.0022 0.341

Training data Constant predictor (normal) Real only Real + augmentation Real + TimeGAN TimeGAN only (TSTR)

8.5. Global Interpretation

RF 0.465 0.465 ± 0.000 0.465 ± 0.000 0.465 ± 0.000 n/a

8.6. Leakage-Aware Benchmark: Tasks Table 25 defines two tasks, T3 and T4. Neither asks a model to recompute a label from the columns that define it. Split protocols. Chronological: the split is computed on the 23,688 real rows only (synthetic rows excluded), ordered in time from 2025-05-19 12:39:08 to 2025-05-20 14:01:00 (nominal step 1 s). The first 60% of samples (14,212, up to 202505-20 00:13:55) is used for training, the next 20% (4,737, up to 2025-05-20 12:03:15) for validation (reserved for hyper-parameter selection and early stopping; not used in the runs reported here), and the last 20% (4,739) for testing. Windows (W=30, stride 5) are built within each split, so that no window overlaps two splits; for T3 this yields 2,837 training, 942 validation and 942 test windows. LOAO (leave-one-attack-type-out) removes one attack type from training and tests whether a detector trained on the others flags it as anomalous (binary detection); this measures generalisation to unseen threats, the practically relevant case. Because the test split contains only replay, the windows of the held-out type are pooled from the three splits (they are never used for training) and scored against the normal windows of the validation and test splits, with a binary normal/attack target; the AUROC is computed per held-out type and averaged over the five types. Positive and negative windows therefore come from different periods, so a temporal shift can contribute to the score. Official indices are in splits.json. Models. Unsupervised (fitted on the normal training windows): Isolation Forest [43] (200 trees, contamination 0.05) and oneclass SVM (RBF kernel, ν = 0.05). Supervised on window statistics (mean, std, min, max, slope, last value and fraction of missing values per channel): RF (200 trees, balanced class weights), XGBoost (200 trees, depth 4) and logistic regression (balanced class weights). Deep models (1D-CNN, LSTM, Transformer, LSTM autoencoder) were not evaluated in this release. All models use default hyper-parameters. Results are mean ± std over 5 seeds. No significance test is reported, since the best models output a constant prediction.

18

Findings. (i) Composition. The chronological split gives 2,837 training windows (2,673 normal, 78 drift, 48 DoS, 20 FDI, 18 replay), 942 validation windows (758 normal, 67 replay, 54 DoS, 53 FDI-stealth, 10 drift) and 942 test windows (819 normal, 123 replay). (ii) Classification. No model exceeds the constant “normal” predictor (macro-F1 0.465). Random Forest and XGBoost reach exactly this value because they label every test window normal (replay recall 0, no alarm, hence no detection delay), and their result does not vary with the seed. Logistic regression falls below it (0.417), with a false-alarm rate of 19.3% and a mean detection delay of 55.3 s; Isolation Forest and the one-class SVM raise 2.2% and 6.0% false alarms and detect no replay segment. (iii) Unseen attack types. The AUROC (RF / logistic regression / Isolation Forest) is 0.784 / 0.236 / 0.797 for DoS, 0.883 / 0.933 / 0.919 for FDI, 0.455 / 0.355 / 0.349 for FDI-stealth, 0.741 / 0.453 / 0.618 for drift and 0.359 / 0.556 / 0.524 for replay, i.e. means of 0.64, 0.51 and 0.64. Detection is above chance for DoS, FDI and drift with RF and Isolation Forest, and at or below chance for FDI-stealth and replay, consistent with their in-range values (Section 5); the a-priori ratings of Table 12 are therefore only partly confirmed (FDI is detected more easily than rated). The FDI estimate rests on a single segment (20 windows), and the positive windows come from all periods whereas the negatives come from the validation and test splits, so a temporal shift may inflate or deflate these values. (iv) Synthetic data. Augmentation (jittering with σ = 0.05 in z-units and scaling, applied to training windows only) and TimeGAN windows (non-overlapping, the four channels absent from TimeGAN set to the training mean) leave the Random Forest unchanged at 0.465 in every configuration, since its prediction stays constant; a paired test is therefore not applicable. The TimeGAN rows carry no attack label, so they cannot supply realistic attack signal, and TimeGAN-only training (TSTR) cannot be evaluated. Table 28 summarises the qualitative characteristics of the candidate models in terms of size and interpretability. No ondevice measurements were performed in this study.

Table 25: Benchmark tasks, inputs, targets, splits and metrics. Task

Input

Target

Split(s)

Metrics

T3 Attack and fault classification

window of the eight observed channels (temperature, humidity, gas_resistance, tds_value, Cl_J7, Cl_J3, TURB_J3, TURB_J7)

attack_type (DoS, FDI, FDI-stealth, drift, replay), fault_type (extreme, spike, white noise; fault windows are labelled normal in the attack target)

macro-F1, per-class recall, detection delay, FAR, LOAO AUROC

T4 Synthetic-data utility

synthetic (TimeGAN) windows (the TimeGAN rows carry no attack label) or augmented training data

as T3

chronological for classification (only replay is present in the test split: FDI occurs in the training split only, stealthy FDI in the validation split only); LOAO by pooling the windows of the held-out type (see text) train synthetic / test real (TSTR)

∆ macro-F1 vs. real-only

Table 26: T3 attack and fault classification (chronological split) and unseen-attack detection (LOAO). Mean ± std over 5 seeds. Macro-F1 is computed over the two classes present in the test set (normal, replay); recalls for FDI-stealth and drift are n/a because neither occurs in the test split. Detection delay is averaged over the runs in which at least one attack segment is detected (number of such runs in parentheses when below 5). Deterministic models (std = 0) give identical results across seeds. LOAO AUROC is the mean over the five held-out attack types (single run, seed 42; per-type values are given in the text); “–”: not computed. Model

Macro-F1

Recall FDI-stealth

Recall drift

Detection delay (s)

FAR (%)

LOAO AUROC

Constant predictor (normal) Isolation Forest One-class SVM Logistic regression Random Forest XGBoost

0.465 – – 0.417 ± 0.000 0.465 ± 0.000 0.465 ± 0.000

n/a – – n/a n/a n/a

n/a – – n/a n/a n/a

n/a n/a (0/5) n/a (0/5) 55.3 ± 0.0 n/a (0/5) n/a (0/5)

0.00 2.20 ± 0.11 5.98 ± 0.00 19.29 ± 0.00 0.00 ± 0.00 0.00 ± 0.00

0.500 0.641 – 0.507 0.644 –

For Random Forest models, the TreeSHAP algorithm [45] allows exact and efficient computation with complexity:

Table 28: Qualitative characteristics of the candidate models (no on-device measurements). Model Random Forest XGBoost 1D-CNN (TFLite)

Model size

Interpretability

Medium (grows with trees/depth) Small to medium Small (after quantisation)

High (feature importance, SHAP) High (feature importance, SHAP) Low (post-hoc only)

O(T LD2 ) where: • T = number of trees,

8.8. Final Model Selection Based on the experimental results, Random Forest is selected as the reference model for the XAI analysis for the following reasons:

• L = number of leaves, • D = maximum tree depth. The SHAP value of feature i is defined as: X |S |!(|F| − |S | − 1)!   ϕi = f (S ∪ {i}) − f (S ) |F|! S ⊆F\{i}

• Macro-F1 equal to the best (0.465, tied with XGBoost and the constant predictor) and the highest mean unseenattack AUROC among the supervised models evaluated (0.64) under the leakage-aware protocol (Table 26) • High interpretability through feature importance and SHAP analysis • Lightweight model family, expected to be compatible with embedded deployment (Table 28)

where: • ϕi is the SHAP value of feature i, • S is a subset excluding feature i, • f (S ) is the model prediction using subset S .

9. SHAP Methodology (SHapley Additive exPlanations)

In this study, SHAP computation produced a tensor of size:

This section analyses the first release, which contained twenty augmented copies of the sensor channels. SHAP is an explainability framework derived from cooperative game theory [44]. It assigns to each feature a contribution score reflecting its marginal impact on the final model prediction. 19

(9 476, 28, 3) corresponding respectively to: • 9,476 test samples (20% of 47,376 rows),

• 28 input variables (the eight label-defining columns and their 20 augmented copies),

individual ranks: temperature_scaled (0.0867) moves above tds_value (0.0850) and just below temperature (0.1046). (ii) After removing the 20 copies, the Random Forest trained • 3 quality classes (Good, Poor, Very Good). on the eight label-defining columns still reaches an accuracy of 0.9904 and a macro-F1 of 0.9866; interventional importance The Random Forest (200 trees, random_state=42) was reconcentrates on temperature (0.193) and tds_value (0.123), trained under the v1 protocol on these 28 inputs and reaches an followed by gas_resistance (0.031), humidity (0.024) and accuracy of 0.9976 and a macro-F1 of 0.9967 on the test split. the four Cl/TURB columns (0.017–0.023). (iii) On the 23,688 The 23,688 synthetic rows have no value for 24 of the 28 inputs; real rows only, which avoids the median imputation of the synthese missing values were imputed with the training-set median thetic block, macro-F1 is 0.9998 and seven of the nine most before standardisation. Global importance was obtained by averaging absolute SHAP important variables are the same as in the full run; eight of the nine belong to the temperature or tds_value groups, but the values over observations and classes: order within the groups changes (temperature_scaled ranks mean_shap = np.mean(np.abs(shap_values), axis=(0,2))first and the raw temperature third). The individual ranking of a column and its copies is therefore not stable, whereas the 9.1. Global Feature Importance Analysis (v1 Protocol) group-level result is. Removing the copies does not make the model valid: the eight remaining columns still define the legacy Table 29 presents the nine most influential variables accordlabel. ing to their mean absolute SHAP value. The feature temperature appears as the dominant predic9.3. Design Implications and Practical Insights tor, with a SHAP value 36% higher than the second-ranked variable (tds_value). Both are label-defining columns, and so are The XAI analysis highlights three major design implicathe other two raw sensor variables in the table (gas_resistance, tions: humidity). None of the node-level simulated variables (e.g. 1. Explainability can audit a dataset. Global SHAP on Cl_J3, TURB_J7) appears among the nine most influential feathe v1 protocol showed that the model relies almost only tures. The model therefore relies on the columns that define on the label-defining columns and their augmented copies the legacy label, which is consistent with label reconstruction (99.7% of the total importance; Cl/TURB columns 0.3%), rather than the detection of a physical water-quality signal. two leakage paths that accuracy alone had hidden. Temperature and tds_value lead the ranking, and the third 2. Labels must not be functions of the inputs. A watervariable is itself a rescaled copy of temperature, highlighting quality label should be derived from water-quality paramthe strong role of the label-defining inputs and of their neareters and must not share columns with the model inputs; duplicates in the legacy label. otherwise the classifier only reconstructs the labelling rule. A marked drop is observed after rank 3 (0.0608 to 0.0276), Here, the ambient variables (temperature, humidity, gas and ranks 4 and 5 are close to each other (0.0276 and 0.0268). resistance) and their copies carry about 67% of the imOf the nine variables, six are augmented copies of temperature portance. or tds_value, which shows how the duplicated features share 3. Compact detection (future work). Whether a model rethe importance of their source column. stricted to the highest-ranked window features keeps its detection performance on the leakage-aware tasks was 9.2. Analysis of Engineered Feature Redundancy not tested here. The augmented columns are not normalised or variability features: _scaled is the raw value multiplied by a random factor, and _jitter is the raw value plus random noise. When correlated copies of a feature are present, tree models split importance among them arbitrarily, so the combined share of a source column and its five copies is the relevant quantity. Summing mean |ϕ| over each source column and its copies (pathdependent TreeSHAP, 9,476 test rows), temperature accounts for 0.216 of the total (50.1%), tds_value for 0.142 (33.0%), gas_resistance for 0.040 (9.4%) and humidity for 0.031 (7.2%); the four columns Cl_J3, TURB_J3, Cl_J7 and TURB_J7 together account for 0.001 (0.3%). The three ambient variables and their copies thus carry about 67% of the total importance. SHAP attributions are known to be unreliable for strongly correlated inputs [46, 47], so we repeated the analysis in three ways. (i) An interventional TreeSHAP (background of 100 training rows, 1,000 explained test rows) gives the same group ordering (temperature 51.8%, tds_value 33.9%) but changes

Methodological Note. SHAP satisfies key axiomatic properties such as efficiency, symmetry, and consistency. Unlike impurity-based Random Forest importance measures, SHAP does not systematically favour continuous high-cardinality variables ; it does, however, share credit among correlated features, which must be taken into account when interpreting rankings. 10. Data Availability and Reuse Repository. The data tables (v1.0, CC BY 4.0) are archived on Zenodo at https://doi.org/10.5281/zenodo.23390541. The source code (MIT), the EPANET/EPANET-MSX model files, the data dictionary (dictionary.csv), the datasheet and the official splits (splits.json) are available on GitHub at 20

Table 29: Top 9 Variables Ranked by Global SHAP Importance (v1 protocol, legacy label, first release, 47,376 rows)

Feature

Mean SHAP

Physical Interpretation / revised reading

1

temperature

0.1159

Air temperature; label input

2

tds_value

0.0850

Total dissolved solids reading; label input

3

temperature_scaled

0.0608

Randomly rescaled copy of rank 1

4

temperature_jitter

0.0276

Noisy copy of rank 1

5

tds_value_scaled

0.0268

Randomly rescaled copy of rank 2

6

gas_resistance

0.0224

VOC proxy indicating volatile contaminants in surrounding air — label input

7

humidity

0.0170

Air humidity; label input

8

tds_value_jitter

0.0159

Noisy copy of rank 2

9

temperature_permuted

0.0065

Permuted copy of rank 1

Rank

https://github.com/nejiamal3-oss/aquasense. Files are provided as CSV. License. Data CC BY 4.0; code MIT. Versioning and extension. Future acquisitions and simulations will be released as new versions under the same concept DOI with an unchanged schema, so results remain comparable. Intended and non-intended uses. Intended: benchmarking anomaly and attack detectors, forecasting, synthetic-data and domain-adaptation research. Not intended: drawing physical conclusions from relations between real and simulated channels, or certifying the potability of real water. 11. Conclusion and Future Directions

• The real sensor acquisition phase covers a short (25.4 h recording window, 8.0 h recorded), limited geographic deployment involving a single indoor installation, which may not fully capture the spatial heterogeneity of largescale distribution networks or seasonal effects. • The number of physical sensor modalities remains constrained by hardware availability. Only TDS is measured in the water; temperature, humidity and gas resistance describe the ambient air, and no immersed temperature probe was available for TDS compensation. Additional real-sensor parameters such as pH, dissolved oxygen, and turbidity would further enrich the dataset. • The real node and the simulated network are independent systems aligned on a common clock; the dataset does not contain physically coupled real–simulated measurements.

11.1. Summary of Contributions This paper presented AquaSense-ICS, an open dataset that co-registers a real 25.4 h recording (8.0 h of recorded data) with a six-species EPANET-MSX network model and adds a seeded library of attacks and faults with sample-level labels. Answering the research questions: (RQ1) the attack and fault labels are traceable to a seeded generator, and the water-quality label to documented thresholds; the water-quality label is constant on the available data; (RQ2) random splits with featurederived labels inflate macro-F1 to 0.9998 on the first release; on the current release the same classifier falls from 0.976 to 0.341 macro-F1 when the random split is replaced by a chronological one; (RQ3) under chronological and leave-attack-typeout splits, no model exceeds the constant predictor in macro-F1 (0.465), and the best detectors reach a mean AUROC of 0.64 on unseen attack types, with detection above chance for DoS, FDI and drift and at or below chance for replay and stealthy FDI. The benchmark offers a template for evaluating other hybrid real–simulated datasets.

• Water-quality labels are rule-based and have not been validated against laboratory grab samples. • Attacks are injected into recorded data (data-level attacks); they do not model the closed-loop physical consequences of manipulated control actions. • The simulated network topology, while representative, does not correspond to a specific real-world infrastructure, which may limit direct applicability to site-specific engineering studies. • Only 11 of the 24 simulated hourly states are matched by real samples, so the simulated contamination events are only partly visible in the fused table, and the turbidity pulse at J7 is not matched by any real sample. • The water-quality label is constant on the available data, so it cannot serve as a classification target.

11.2. Limitations The current version of the dataset presents several limitations that should be acknowledged by users:

• The TDS values are not calibrated and carry no unit.

21

• Three of the five attack types (FDI, stealthy FDI and DoS) act only on simulated channels.

CRediT authorship contribution statement A.N: Conceptualization, Methodology, Software, Investigation, Writing – original draft. M.F: Data curation, Validation, Writing – review & editing. L.C.F: Data curation, Validation, Writing – review, editing & Supervision.

• The release contains 14 attack segments (FDI and stealthy FDI one each), so attack types cannot be spread over the training, validation and test splits; generalisation to unseen attack types is evaluated only by pooling windows across splits, from very few segments per type (a single one for FDI and stealthy FDI), and the resulting AUROC values are indicative.

Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

• The disturbances applied to the sensor were not recorded in a machine-readable log. 11.3. Future Research Directions Several extension and improvement directions for the AquaSense-ICS dataset have been identified:

Data availability

1. Expansion of Real Data Acquisition. Future versions will extend the real data collection phase to multiple field deployments across geographically diverse sites. Additional physicochemical sensors, such as pH electrodes, dissolved oxygen optical probes, and nephelometric turbidity sensors, will be integrated, together with an immersed temperature probe and periodic laboratory grab samples for label validation. This will enrich the real sensing modalities and improve ecological representativeness. 2. Larger and More Complex Simulated Networks. The simulated network topology will be expanded toward larger and more complex water distribution systems, including multi-zone networks with elevated tanks, booster pumping stations, and pressure management areas, starting with the public L-TOWN and C-Town models so that results can be compared with BattLeDIM and BATADAL. This will enable spatially distributed simulation data with finer hydraulic resolution. 3. Enhanced Cyber-Physical Attack Library. The cyberphysical attack library will be enriched with new categories designed to increase realism, including coordinated multi-point contamination injection scenarios, physically coherent sensor spoofing patterns, and stealthy lowrate intrusions. 4. Extended Temporal Coverage. The dataset timeline will be expanded to cover full seasonal cycles, capturing the effects of temperature variation, demand seasonality, and environmental factors on sensor readings and hydraulic behavior. 5. Refined Labeling Methodology. The annotation methodology will be improved through collaboration with water quality domain experts to integrate regulatory thresholds from multiple national standards, resulting in a more nuanced and internationally applicable quality labeling system. 6. Federated and foundation-model studies: With multiple deployment sites, the dataset will support federated learning across sites and the evaluation of pre-trained timeseries foundation models, which the present single-site version cannot meaningfully test. 22

The data (CC BY 4.0) are archived on Zenodo at https:// doi.org/10.5281/zenodo.23390541 and the source code (MIT) is available on GitHub at https://github.com/nejiamal3-oss/ aquasense (see Section 10). Declaration of generative AI and AI-assisted technologies in the manuscript preparation process During the preparation of this work the authors used Claude (Anthropic) in order to revise the wording and the LaTeX structure of the manuscript. After using this tool, the authors reviewed and edited the content as needed and take full responsibility for the content of the published article. Acknowledgements This research received no specific grant from any funding agency in the public, commercial or not-for-profit sectors. / Funding sources and acknowledgements. References [1] United Nations Statistics Division, The sustainable development goals report 2023 – goal 6: Clean water and sanitation, https://unstats.un.org/sdgs/report/ 2023/Goal-06/, accessed: 2026-09-23 (2023).

[2] UNESCO, Imminent risk of a global water crisis, warns the UN world water development report 2023, https://www.unesco.org/en/articles/ imminent-risk-global-water-crisis-warns-un-world-wa accessed: 2026-09-23 (2023). [3] World Health Organization, Drinking-water (fact sheet), https://www.who.int/news-room/fact-sheets/ detail/drinking-water, accessed: 2026-09-23 (2023). [4] F. Jan, N. Min-Allah, D. Düştegör, IoT based smart water quality monitoring: Recent techniques, trends and challenges for domestic applications, Water 13 (13) (2021) 1729. doi:10.3390/w13131729.

[5] E. T. de Camargo, F. A. Spanhol, J. S. Slongo, M. V. R. da Silva, J. Pazinato, A. V. de Lima Lobo, F. R. Coutinho, F. W. D. Pfrimer, C. A. Lindino, M. S. Oyamada, L. D. Martins, Low-cost water quality sensors for IoT: A systematic review, Sensors 23 (9) (2023) 4424. doi:10. 3390/s23094424.

[15] A. P. Mathur, N. O. Tippenhauer, SWaT: A water treatment testbed for research and training on ICS security, in: 2016 International Workshop on Cyber-physical Systems for Smart Water Networks (CySWater), IEEE, 2016, pp. 31–36. doi:10.1109/CySWater.2016.7469060. [16] J. Goh, S. Adepu, K. N. Junejo, A. Mathur, A dataset to support research in the design of secure water treatment systems, in: Critical Information Infrastructures Security (CRITIS 2016), Vol. 10242 of Lecture Notes in Computer Science, Springer, 2017, pp. 88–99. doi: 10.1007/978-3-319-71368-7_8.

[6] M. Miller, A. Kisiel, D. Cembrowska-Lech, I. Durlik, T. Miller, IoT in water quality monitoring—are we really here?, Sensors 23 (2) (2023) 960. doi:10.3390/ s23020960. [7] S. N. Zainurin, W. Z. Wan Ismail, S. N. I. Mahamud, I. Ibrahim, J. Jamaludin, K. N. Z. Ariffin, W. M. Wan Ahmad Kamil, Advancements in monitoring water quality based on various sensing methods: A systematic review, International Journal of Environmental Research and Public Health 19 (21) (2022) 14080. doi:10.3390/ ijerph192114080.

[17] C. M. Ahmed, V. R. Palleti, A. P. Mathur, WADI: A water distribution testbed for research in the design of secure cyber physical systems, in: Proceedings of the 3rd International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWATER ’17), ACM, 2017, pp. 25– 28. doi:10.1145/3055366.3055375.

[8] R. Taormina, S. Galelli, Deep-learning approach to the detection and localization of cyber-physical attacks on water distribution systems, Journal of Water Resources Planning and Management 144 (10) (2018) 04018065. doi:10.1061/(ASCE)WR.1943-5452.0000983.

[18] F. Shang, J. G. Uber, L. A. Rossman, Modeling reaction and transport of multiple species in water distribution systems, Environmental Science & Technology 42 (3) (2008) 808–814. doi:10.1021/es072011z. [19] F. Shang, J. G. Uber, L. A. Rossman, EPANET multispecies extension user’s manual, Tech. Rep. EPA/600/S07/021, U.S. Environmental Protection Agency, Cincinnati, OH (2008).

[9] L. Tsiami, C. Makropoulos, Cyber–physical attack detection in water distribution systems with temporal graph convolutional neural networks, Water 13 (9) (2021) 1247. doi:10.3390/w13091247.

[20] T. Gebru, J. Morgenstern, B. Vecchione, J. W. Vaughan, H. Wallach, H. Daumé III, K. Crawford, Datasheets for datasets, Communications of the ACM 64 (12) (2021) 86– 92. doi:10.1145/3458723.

[10] S. Kapoor, A. Narayanan, Leakage and the reproducibility crisis in machine-learning-based science, Patterns 4 (9) (2023) 100804. doi:10.1016/j.patter.2023. 100804.

[21] M. D. Wilkinson, M. Dumontier, I. J. Aalbersberg, et al., The FAIR guiding principles for scientific data management and stewardship, Scientific Data 3 (2016) 160018. doi:10.1038/sdata.2016.18.

[11] Y. Liu, P. Ning, M. K. Reiter, False data injection attacks against state estimation in electric power grids, ACM Transactions on Information and System Security 14 (1) (2011) 13:1–13:33. doi:10.1145/1952982.1952995.

[22] Open Water AI Initiative, WaterBench: A benchmark dataset for water systems [delete] (2023).

[12] R. Taormina, S. Galelli, N. O. Tippenhauer, E. Salomons, A. Ostfeld, D. G. Eliades, et al., Battle of the attack detection algorithms: Disclosing cyber attacks on water distribution networks, Journal of Water Resources Planning and Management 144 (8) (2018) 04018048. doi: 10.1061/(ASCE)WR.1943-5452.0000969.

[23] L. A. Rossman, EPANET-based simulation studies in water networks [delete] (2019). [24] L. A. Rossman, EPANET 2 users manual, Tech. Rep. EPA/600/R-00/057, U.S. Environmental Protection Agency, Cincinnati, OH (2000).

[13] M. Housh, Z. Ohar, Model-based approach for cyberphysical attack detection in water distribution systems, Water Research 139 (2018) 132–143. doi:10.1016/j. watres.2018.03.039.

[25] L. A. Rossman, H. Woo, M. Tryby, F. Shang, R. Janke, T. Haxton, EPANET 2.2 user manual, Tech. Rep. EPA/600/R-20/133, U.S. Environmental Protection Agency, Washington, DC (2020).

[14] S. G. Vrachimis, D. G. Eliades, R. Taormina, Z. Kapelan, A. Ostfeld, S. Liu, M. Kyriakou, P. Pavlou, M. Qiu, M. M. Polycarpou, Battle of the leakage detection and isolation methods, Journal of Water Resources Planning and Management 148 (12) (2022) 04022068. doi:10.1061/ (ASCE)WR.1943-5452.0001601.

[26] S. G. Vrachimis, M. S. Kyriakou, D. G. Eliades, M. M. Polycarpou, LeakDB: A benchmark dataset for leakage diagnosis in water distribution networks, in: WDSA/CCWI Joint Conference Proceedings, Vol. 1, Kingston, Ontario, Canada, 2018. 23

[27] A. A. Abokifa, K. Haddad, C. Lo, P. Biswas, Real-time identification of cyber-physical attacks on water distribution systems via machine learning–based anomaly detection techniques, Journal of Water Resources Planning and Management 145 (1) (2019) 04018089.

[38] L. A. Rossman, R. M. Clark, W. M. Grayman, Modeling chlorine residuals in drinking-water distribution systems, Journal of Environmental Engineering 120 (4) (1994) 803–820. [39] T. T. Um, F. M. J. Pfister, D. Pichler, S. Endo, M. Lang, S. Hirche, U. Fietzek, D. Kulić, Data augmentation of wearable sensor data for Parkinson’s disease monitoring using convolutional neural networks, in: Proceedings of the 19th ACM International Conference on Multimodal Interaction (ICMI), 2017, pp. 216–220. doi:10.1145/ 3136755.3136817.

[28] KIOS Center of Excellence, University of Cyprus, BattLeDIM 2020: Battle of the leakage detection and isolation methods, https://battledim.ucy.ac.cy/, accessed: 2026-09-23 (2020). [29] C. Bergmeir, J. M. Benítez, On the use of cross-validation for time series predictor evaluation, Information Sciences 191 (2012) 192–213. doi:10.1016/j.ins.2011.12. 028.

[40] B. K. Iwana, S. Uchida, An empirical survey of data augmentation for time series classification with neural networks, PLOS ONE 16 (7) (2021) e0254841. doi:10. 1371/journal.pone.0254841.

[30] Bosch Sensortec, BME680 – low power gas, pressure, temperature & humidity sensor: Datasheet, https://www.bosch-sensortec.com/products/ environmental-sensors/gas-sensors/bme680/, accessed: 2026-09-23 (2022).

[41] J. Yoon, D. Jarrett, M. van der Schaar, Time-series generative adversarial networks, in: Advances in Neural Information Processing Systems, Vol. 32, 2019.

[31] World Health Organization, Guidelines for DrinkingWater Quality: Fourth Edition Incorporating the First and Second Addenda, World Health Organization, Geneva, 2022.

[42] European Parliament and Council of the European Union, Directive (EU) 2020/2184 of 16 december 2020 on the quality of water intended for human consumption, Official Journal of the European Union, L 435, 23.12.2020, pp. 1– 62 (2020).

[32] ASHRAE, ANSI/ASHRAE standard 55-2020: Thermal environmental conditions for human occupancy, ASHRAE, Atlanta, GA (2020).

[43] F. T. Liu, K. M. Ting, Z.-H. Zhou, Isolation forest, in: 2008 Eighth IEEE International Conference on Data Mining, 2008, pp. 413–422. doi:10.1109/ICDM.2008.17.

[33] A. A. Albustami, A. F. Taha, Breaking the flow and the bank: Stealthy cyberattacks on water network hydraulics, Water research 283 (2025) 123719.

[44] S. M. Lundberg, S.-I. Lee, A unified approach to interpreting model predictions, in: Advances in Neural Information Processing Systems, Vol. 30, 2017.

[34] S. M. Elsherif, S. Wang, A. F. Taha, L. Sela, M. H. Giacomoni, A. A. Abokifa, Control-theoretic modeling of multi-species water quality dynamics in drinking water networks: Survey, methods, and test cases, Annual Reviews in Control 55 (2023) 466–485.

[45] S. M. Lundberg, G. Erion, H. Chen, A. DeGrave, J. M. Prutkin, B. Nair, R. Katz, J. Himmelfarb, N. Bansal, S.-I. Lee, From local explanations to global understanding with explainable AI for trees, Nature Machine Intelligence 2 (1) (2020) 56–67. doi:10.1038/ s42256-019-0138-9.

[35] S. M. Elsherif, A. F. Taha, A. A. Abokifa, L. Sela, Comprehensive framework for controlling nonlinear multispecies water quality dynamics, Journal of Water Resources Planning and Management 150 (2) (2024) 04023077.

[46] D. Janzing, L. Minorics, P. Blöbaum, Feature relevance quantification in explainable AI: A causal problem, in: Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics (AISTATS), Vol. 108 of Proceedings of Machine Learning Research, PMLR, 2020, pp. 2907–2916.

[36] J. Li, K. Malialis, S. G. Vrachimis, M. M. Polycarpou, Online detection of water contamination under concept drift, in: 2025 IEEE Symposia on Computational Intelligence for Energy, Transport and Environmental Sustainability (CIETES Companion), IEEE, 2025, pp. 1–5.

[47] K. Aas, M. Jullum, A. Løland, Explaining individual predictions when features are dependent: More accurate approximations to Shapley values, Artificial Intelligence 298 (2021) 103502. doi:10.1016/j.artint.2021. 103502.

[37] S. D. Richardson, M. J. Plewa, E. D. Wagner, R. Schoeny, D. M. DeMarini, Occurrence, genotoxicity, and carcinogenicity of regulated and emerging disinfection byproducts in drinking water: A review and roadmap for research, Mutation Research/Reviews in Mutation Research 636 (1–3) (2007) 178–242. doi:10.1016/j.mrrev. 2007.09.001. 24

Related documents

• AquaSense-ICS: A Hybrid Real-Simulated Cyber-Physical Dataset and Leakage-Aware Benchmark for Smart Water Quality Monitoring and Attack Detection#1448177
• The designing of a transparent hybrid machine learning framework for water leak detection: a systematic review.#172006
• Confidence-driven lightweight adaptive online deep learning for IoT intrusion detection#1169166
• Automated Batch Distillation Process Simulation for a Large Hybrid Dataset for Deep Anomaly Detection#799999
• Benchmarking of Machine Learning for Anomaly Based Intrusion Detection Systems in the CICIDS2017 Dataset#199534