Closing the Applied Cybersecurity Gap in Critical Infrastructure: A Cyber-to-Physical Security Assessment Framework for Water Systems

Closing the Applied Cybersecurity Gap in Critical Infrastructure: A Cyber-to-Physical Security Assessment Framework for Water Systems Halil I. Dursunoglua,∗, Kaan Sulkalarb

arXiv:2610.41050v1 [cs.CR] 29 Oct 2026

a Department of Computer Science, Western Michigan

University, Kalamazoo, Michigan, USA b Department of Computer Information Systems, Western Michigan

University, Kalamazoo, Michigan, USA

Abstract The integration of information technology and operational technology in water infrastructure creates pathways through which cyber compromise may affect physical service delivery. This study revisits the Applied Cybersecurity Gap (ACG) framework by evaluating an experimental Applied Cybersecurity Gap Index (ACGI) alongside the Cyber-to-Physical Propagation Rate (CPPR), defined as the proportion of initially compromised trials that produce a specified physical-impact outcome. The expanded evaluation comprises 2,160 synthetic trials across three water-network benchmarks, including EPANET Example Network 3 (Net3), and couples declared cyber-attack progression rules with hydraulic simulations. A source-trained machine-learning model evaluated on 247 compromised Net3 trials achieved ROC-AUC 0.772, PR-AUC 0.775, and F1 0.733, compared with 0.661, 0.642, and 0.704 for a scenario-only baseline. The configuration-cluster bootstrap interval for the ROC-AUC difference was 0.038– 0.183. A separate 720-run Net3 hydraulic operating-point sensitivity analysis achieved the study’s exploratory baseline pressure criterion in all reruns, preserved 717 of 720 physical-impact labels, and produced ROC-AUC 0.791 with the frozen source-trained model. Additional analyses examine the sensitivity of CPPR to the physical-impact threshold and assumed control-blocking probabilities, and demonstrate that the ACGI–CPPR association is partly induced by the simulation design rather than independently validated. The findings establish a reproducible simulation-based assessment workflow, but do not constitute field calibration of cybersecurity-control effectiveness or prediction of real-world utility incidents. Keywords: Operational technology, Water distribution, Cyber-to-physical propagation, Applied Cybersecurity Gap, Cross-network transfer, WNTR, ∗ Corresponding author

Email addresses: halilibrahim.dursunoglu@wmich.edu (Halil I. Dursunoglu), kaan.sulkalar@wmich.edu (Kaan Sulkalar)

Hydraulic sensitivity

1. Introduction Critical infrastructure systems increasingly depend on the integration of information technology (IT), operational technology (OT), communication networks, and automated control mechanisms to maintain essential services. Water distribution infrastructure represents a particularly important example of this integration because its operational continuity directly affects public health, economic activity, emergency response, and community resilience. Modern water utilities employ supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), remote monitoring devices, and networkconnected actuators to regulate pumping operations, storage levels, pressure conditions, and water delivery. Although these technologies improve operational visibility and efficiency, they also introduce cybersecurity dependencies into physical processes that were traditionally managed within more isolated industrial environments. The convergence of IT and OT creates security challenges that differ from those encountered in conventional enterprise networks. A cybersecurity incident affecting a business application may primarily compromise information confidentiality, integrity, or availability, whereas an incident involving industrial control systems can also alter physical operating conditions. Unauthorized changes to pump commands, controller settings, sensor measurements, or communication pathways may disrupt the coordination between hydraulic infrastructure and its supervisory systems. Depending on the affected assets, operating conditions, and available safeguards, these disruptions may contribute to abnormal pressure, storage-level deviations, equipment stress, or interruptions in service. Consequently, evaluating cybersecurity in water infrastructure requires consideration of both digital compromise and its potential consequences for physical operations. NIST SP 800-82 Revision 3 emphasizes the distinctive performance, reliability, and safety requirements of OT environments and the importance of incorporating these requirements into cybersecurity practices [1]. Cybersecurity frameworks provide established mechanisms for identifying assets, assessing threats, implementing safeguards, and organizing risk-management activities. The NIST Cybersecurity Framework 2.0, for example, establishes high-level cybersecurity outcomes that organizations can use to structure governance and operational improvements [2]. However, the existence of a cybersecurity policy, architectural requirement, or prescribed control does not necessarily demonstrate that the corresponding protection has been fully implemented or remains effective under operational conditions. Differences may arise from legacy equipment, inconsistent access-control enforcement, incomplete network segmentation, delayed maintenance, limited monitoring coverage, or constraints imposed by continuous industrial operations. These differences are particularly consequential in environments where multiple security mechanisms must function together to prevent an initial intrusion from reaching operational assets. 2

This study examines such differences through the concept of the Applied Cybersecurity Gap (ACG), defined as the discrepancy between intended cybersecurity protection and its implementation within an operational environment. The ACG concept emphasizes the distinction between documenting a security requirement and establishing that the corresponding safeguard is present and operationally meaningful. To support quantitative experimentation, the study uses an Applied Cybersecurity Gap Index (ACGI) that aggregates five normalized dimensions: external exposure, access control, IT/OT segmentation, detection capability, and recovery capability. These dimensions represent different aspects of the protection environment and are modeled as explicit experimental inputs. The index is intended to provide an interpretable representation of security-control implementation gaps rather than replace established vulnerability-scoring systems or serve as an independently validated measure of organizational cyber risk. A further challenge arises from the distinction between successful initial compromise and the subsequent development of physical consequences. An attacker obtaining access to an exposed digital asset does not necessarily gain control of operational equipment, and reaching an OT component does not necessarily produce a measurable disruption. Network segmentation, access restrictions, controller behavior, process constraints, and hydraulic operating conditions may interrupt or modify the progression of an attack. Conversely, a seemingly limited compromise may have substantial operational implications when it affects an asset with direct influence over the physical process. Treating these stages as a single binary security outcome can obscure the mechanisms through which cybersecurity weaknesses become infrastructure-level consequences. To examine this progression, the study employs the Cyber-to-Physical Propagation Rate (CPPR), defined as the proportion of initially compromised experimental trials that produce a specified physical-impact outcome. This conditional measure distinguishes the initial compromise event from the subsequent occurrence of measurable physical disruption. In the proposed evaluation, cyber compromise and OT reachability are generated using declared security-dependent simulation rules, while physical-impact outcomes are obtained from hydraulic simulations. The separation of these stages makes the experimental assumptions explicit and permits analysis of how modeled security conditions, attack scenarios, and hydraulic responses contribute to the observed propagation outcomes. CPPR is therefore interpreted as a conditional outcome measure within the simulated environment, not as an empirically established probability of disruption in operational water utilities. Existing research has provided important foundations for studying cyberphysical security in water infrastructure. Physical and cyber-physical testbeds, including Secure Water Treatment (SWaT) and Water Distribution (WADI), have enabled investigation of attack scenarios, process monitoring, and anomaly detection under controlled experimental conditions [3, 4, 5]. The Battle of the Attack Detection Algorithms (BATADAL) has further supported comparative evaluation of detection methods for water distribution networks [6]. Modelbased approaches have investigated the use of hydraulic behavior and residual 3

analysis to identify potentially malicious disturbances [7]. Collectively, these studies demonstrate the importance of incorporating process knowledge into cybersecurity assessment rather than relying exclusively on conventional networksecurity indicators. More recent investigations have expanded the application of machine learning, hydraulic models, and digital-twin approaches to cyber-physical watersystem security. Parajuli and Shin examined machine-learning-based identification of failure types in cyber-physical water distribution networks [8], while Pandey et al. investigated digital-twin-supported anomaly detection and localization [9]. Raza and Moazeni proposed a framework integrating cyberattack detection, localization, and severity assessment in smart water systems [10]. Homaei et al. explored causal digital twins for anomaly detection in water-related cyber-physical environments [11]. Recent reviews also document the growing diversity of artificial-intelligence-based attack-detection techniques and the challenges associated with evaluating them across heterogeneous watersystem datasets [12]. These developments provide a strong methodological foundation, but their principal evaluation targets often concern attack detection, event classification, localization, or severity estimation rather than the conditional prediction of physical impact following an established cyber compromise. The present research develops an integrated assessment and evaluation framework connecting cybersecurity implementation gaps, simulated attack progression, hydraulic-process responses, and machine-learning prediction. The framework combines explicitly defined security-control variables with six attack-scenario categories and paired baseline-versus-attack hydraulic simulations. It evaluates three network benchmarks, each containing 720 experimental trials. Two synthetic networks, designated A and B, support bidirectional transfer experiments and source-model training, while EPANET Example Network 3 (Net3) provides an additional held-out hydraulic benchmark. Net3 includes 92 junctions, 117 pipes, two pumps, and three storage tanks. Its inclusion enables assessment of physical-impact outcomes in a network with a more detailed hydraulic structure than the simplified representations used in earlier versions of this research. The contribution of this research is fourfold. First, it formalizes an experimental representation of applied cybersecurity-control gaps and distinguishes this construct from established vulnerability and risk-management measures. Second, it defines a conditional cyber-to-physical propagation outcome that separates initial compromise, OT reachability, and physical-process impact. Third, it implements a reproducible multi-network evaluation protocol combining synthetic security scenarios, WNTR-based hydraulic simulation, source-only machine-learning transfer, feature ablations, and configuration-aware uncertainty estimation. Fourth, it examines the sensitivity of the resulting physicalimpact labels and predictive performance to a documented change in the hydraulic operating point. Together, these elements provide an integrated methodology for investigating the relationship between modeled cybersecurity weaknesses and simulated physical consequences in water infrastructure.

4

2. Related work and positioning NIST SP 800-82 Rev. 3 provides control-oriented OT security guidance, not a trial-level probability of physical propagation [1]. The NIST Cybersecurity Framework describes organizational outcomes rather than a water-networkspecific conditional propagation estimator [2]. SWaT and WADI research investigates attacks and process telemetry in physical testbeds [5, 3, 4]. BATADAL compares attack-detection algorithms for water distribution systems [6]. Our objective differs: predict conditional physical propagation after a synthetic cyber foothold and test transfer across different simulated hydraulic networks. We do not claim superior attack detection over those systems because their data, tasks, and experimental protocols differ. Table 1 summarizes the scope and limitations of representative water-sector cybersecurity approaches. Table 1: Representative related approaches and differences in evaluated tasks.

Approach

Primary method or output OT controls and engineering guidance Physical-process anomaly rules Physical waterdistribution testbed Comparative attack detection

Strength

Model-based hydraulics [7]

Hydraulic residuals for attack detection

Mechanistic tional baseline

Stealthy hydraulic attacks [13] Digital twin localization [9]

False-data-injection attack impacts

Attack-impact mechanisms

Learning-based anomaly localization ACGI, CPPR, synthetic hydraulics and source-only transfer

Network-model gration

midrule NIST OT guidance [1] SWaT process invariants [3] WADI [4] BATADAL [6]

This study

Operational control scope Process-aware attack evidence Physical realism Common attackdetection benchmark

opera-

inte-

Explicit held-outnetwork and operatingpoint sensitivity

Not directly assessed Trial-level CPPR Cross-network CPPR transfer This paper’s ACGI target Conditional postcompromise outcome Conditional postcompromise risk Our securitygap index Our targetnetwork transfer Field validation and fair same-task SOTA reproduction

2.1. Recent reviewer-identified studies and novelty boundary A systematic review by Tuptuk et al. [14] surveys the cybersecurity landscape of water systems, including vulnerabilities, attack surfaces, and challenges 5

in safeguarding interconnected operations. This sector-wide synthesis motivates assessment of implemented controls but does not supply a calibrated conditional post-compromise propagation metric. Raza and Moazeni [10] developed optimized reconstruction-based attack detectors, localization methods, and a severity index for water-distribution networks using BATADAL and C-Town. Their severity construct quantifies attack consequences and must be acknowledged as prior work on quantitative water-system impact assessment; our CPPR instead defines a binary physical-impact frequency conditional on an initial foothold, and is not claimed to be the first impact measure. Wang et al. [15] developed output-constrained secure second-order slidingmode control for drinking-water coagulation under false-data-injection and denialof-service attacks, with theoretical stability analysis and experimental case studies. Their work addresses preservation of physical-process control performance under attack rather than estimation of security-gap scores. Voggensberger et al. [16] introduced a context-aware methodology for selecting and weighting cybersecurity controls for water-sector industrial control systems. Their study is particularly relevant to ACGI: context-dependent and weighted control assessment is established prior art, and the present work does not claim to originate either concept. Its distinct methodological question is whether declared control-gap assumptions can be linked to a separately defined conditional propagation endpoint and tested for consistency under hydraulic operating changes and source-to-target network transfer. Because the security assumptions remain synthetic, this linkage is not independent field validation of control effectiveness. Table 2 compares the four reviewer-recommended studies with the present framework and identifies the limits of direct performance comparisons. Recent reviews of security in water treatment and distribution summarize threat classes, industrial control dependencies, and the practical constraints of intrusion detection [17]. For instance, the BATADAL benchmark compares attack detection on a common water-network benchmark [6], while model-based fault detection uses hydraulic state estimation to identify cyber-induced anomalies [7]. These are useful methodological precedents, but they do not directly estimate the post-compromise physical-impact endpoint used here. More recent research has investigated stealthy false-data-injection effects on hydraulic operations [13], flood consequences of attacks on smart stormwater controls [18], and machine-learning digital twins for distribution-network anomaly localization [9]. The distinctions among detection, localization, physical severity and conditional propagation motivate reporting explicit target definitions rather than comparing unlike accuracy scores. Recent work has also studied failure classification with WNTR and epanetCPA [8], temporal graph models on BATADAL [19], and a 2025 hybrid classifier for water-system attack detection [20]. These methods target event detection or failure identification, whereas the present task is prediction of a physical-impact label conditional on a simulated initial foothold. Their reported scores cannot be fairly compared numerically without reconstructing a common outcome definition, observation window, and train/test protocol. A recent systematic review synthesizes AI-based water-distribution attack-detection approaches and 6

Table 2: Direct comparison with the four publications identified by Reviewer 1. Reported performance across these studies is not numerically comparable because outcomes and experimental protocols differ. Study

Primary contribution

Tuptuk et al. [14]

Systematic review water cybersecurity

Raza Moazeni [10]

and

Wang et al. [15]

Voggensberger al. [16]

This study

et

Evaluation basis

Distinction from this work

of

Published research synthesis

Attack detection, localization, severity index

BATADAL and C-Town

Output-constrained secure coagulation control

Analytical, simulated and experimental control evaluation

Context-aware selection and weighting of ICS security controls

Plant-context security assessment methodology

Synthetic ACGI, conditional CPPR, crossnetwork prediction

A/B/Net3 simulation and WNTR sensitivity

Not a trial-level propagation experiment Severity/detection rather than conditional CPPR Resilient control rather than control-gap measurement Strong overlap with control weighting; no claimed novelty for weighted scoring No empirical security calibration or expert interviews

highlights the variety of benchmark settings [12]. Raza and Moazeni combine detection, localization, and a severity index in C-Town [10]; Homaei et al. investigate causal digital twins and counterfactual reasoning on SWaT, WADI and HAI [11]. These studies sharpen the distinction between event detection, impact severity, and the present conditional propagation target. Neither their published detection scores nor their testbed results are directly comparable with the synthetic post-compromise labels used here. For hydraulic-model reproducibility, the EPANET 2.2 manual describes the extended-period network state variables and solution assumptions [21]; the WNTR manual and its associated software-framework publication document Python-based resilience experiments [22, 23]. Broader water-network research on operational hydraulic anomalies and energy management [24] further emphasizes that hydraulic feasibility and security-event prediction are related but distinct evaluation problems. 3. Materials and methods 3.1. Research workflow and study design The workflow is: (i) generate a security configuration and attack scenario; (ii) simulate initial compromise and OT reach using declared rules; (iii) run paired baseline and attack hydraulic trajectories; (iv) label material pressure or

7

tank deviation; (v) train on source networks only; (vi) evaluate on held-out networks; (vii) audit baseline pressure and conduct a separate Net3 operating-point sensitivity. No attack-induced hydraulic quantity or target label is included in pre-attack model features. We report precision–recall AUC alongside ROC-AUC because the prevalence of physical-impact labels is not fixed across networks, and PR evaluation can be especially informative under class imbalance [26]. Machine-learning implementation follows established Python scientific-learning conventions [27]. The sequence of security simulation, paired hydraulic evaluation, and held-out-network prediction is illustrated in Fig. 1.

Security gaps + scenario Synthetic initial compromisePaired WNTR baseline Physical-impact labelsSource-only model training Tank operating-point audit + operating context and OT reach and attack hydraulics (pressure/tank deviation)held-out network testingfrozen-model sensitivity

Figure 1: Study workflow. Security outcomes are synthetic; physical labels come from paired hydraulic trajectories; target-network fitting is prohibited.

3.2. Security-gap construct and conditional propagation Let g = (E, A, S, D, R) denote five normalized implementation gaps: external exposure, access, IT/OT segmentation, detection, and recovery, each in [0, 1] with higher values representing weaker protection. We use ACGIw =

5 X

wj ≥ 0,

wj gj ,

j=1

X

wj = 1.

(1)

j

Equal weights (wj = 0.2) form an interpretable reference, not empirically estimated causal weights. ACGI is an experimental composite of predefined gap inputs, not a substitute for CVSS, risk-based asset prioritization, or an externally validated security score. In the primary combined predictor, component gaps are used directly rather than simultaneously including their deterministic weighted sum. Earlier A/B ablations included alternative weighting and leave-one-dimension-out tests; they are sensitivity analyses, not evidence that a universal set of weights has been identified. For Ii indicating initial compromise and Yi indicating physical impact, define P = 1, Yi = 1) \ = i 1(I Pi CPPR . (2) i 1(Ii = 1) This is an empirical conditional fraction in the synthetic experiment. For example, Net3 produced 247 initial compromises and 137 impacts, so its empirical CPPR is 137/247 = 0.555. A different denominator, 172 trials that reached OT, gives 137/172 = 0.797 and must not be called the same quantity. 8

3.3. Hydraulic networks, dataset provenance, and scenarios The study uses two synthetic water-network configurations (A and B) and EPANET Example Network 3 (Net3) loaded from the WNTR distribution. Each network has 720 generated trials, giving 2,160 trials before filtering. A and B yielded 217 and 185 compromised trials, respectively; Net3 yielded 247. Net3 includes 92 junctions, 117 pipes, two pumps, three tanks, and no physical valves. The input network file was tracked using a SHA-256 digest recorded in the reproducibility manifest. These are newly generated trial-level datasets, not field-collected attack incidents. The six attack labels are remote access, PLC setpoint manipulation, sensor spoofing, valve manipulation, pump override, and command replay. In Net3, the valve-manipulation label is implemented by isolating pipe 205 because Net3 has no valve; it is explicitly a pipe-isolation proxy. Other scenarios share simplified pump-status interventions, while replay alternates status. Scenario names should not be read as six independently validated physical attack mechanisms. The Net3 design includes 120 trials per scenario (six scenarios, 720 trials), distributed over 40 security-configuration clusters. The generator determines initial compromise and OT reach before hydraulics; this distinction is essential because physical outcomes are never independent of those rules. For a concrete interpretation, a configuration with component gaps (0.8, 0.6, 0.4, 0.2, 0.0) has equal-weight ACGI 0.40; this arithmetic example is illustrative rather than an observed utility measurement. ACGI alone cannot identify which control should be remediated without examining the five components and attack paths. Each attack trajectory is compared against a matched no-attack trajectory with the same operating inputs. A physical impact is flagged for OT-reached trials when the maximum pressure deviation reaches 5 m or the maximum tank-level deviation reaches 0.35 m. These are exploratory research thresholds, not statutory water-service limits. Hydraulics are solved using WNTRSimulator in demand-driven mode. Baselines and attacked runs are matched; pressure is evaluated at five-minute reporting timestamps. Net3 junction 10, an immediate pump-adjacent zero-demand node, is excluded from the service-pressure feasibility screen after a documented audit found localized negative pressure there. Its exclusion is not used to erase or change physical-impact labels: an earlier all-versus-excluding-junction-10 rerun changed zero labels in 720 trials. The 91 other junctions remain monitored. The study does not establish that all nodes satisfy regulatory pressure requirements. 3.4. Prediction, ablations, and leakage safeguards The prediction target is Y conditional on I = 1. The source-only training set consists of compromised trials from A and B (217 + 185 = 402); Net3 is held out (247 compromised trials). Additional tests train on A and evaluate on B, and vice versa. Four model inputs are compared: combined security gaps and scenario/operating features; scenario-only; security-only; and hydraulic-only. The original experimental implementation is deterministically reconstructed and checked against saved predictions; maximum absolute prediction discrepancy is

9

below 10−6 . Net3 labels, features, and threshold are never used to refit or tune the source models. Trials share a configuration and therefore are not independent observations. Holdout is by network, and uncertainty is estimated by resampling target configuration IDs (3,000 resamples). This captures target-configuration sampling variation conditional on a fitted source model; it does not capture model-retraining uncertainty, parameterization uncertainty, or field deployment variation. Performance measures are ROC-AUC, PR-AUC, F1 at the preselected 0.5 threshold, and Brier score. AUC comparisons are made against matched ablations; they are not presented as head-to-head results against unrelated published detection systems. 3.5. Hydraulic operating-point sensitivity The original Net3 operating point was infeasible under an exploratory minimum pressure of 5 m at the 91 service-monitored junctions. A 24-trial demandfactor pilot tested 264 baseline evaluations and found no feasible factor; junction 40 was consistently limiting. A separate predefined screen of allowable initial tank-level increments selected a +4 m adjustment to Tank 1, within its stated tank-level bounds. This selection used baseline pressure only, not attack labels. The complete 720-trial experiment then reran matched hydraulics with all cyber outcomes and impact thresholds fixed. A further source-only ML sensitivity increased the mean initial tank-level feature by 4/3 m (three tanks) and evaluated adjusted labels without target retraining. 4. Results 4.1. Cross-network transfer Table 3 reports cross-network predictive performance on initially compromised trials, including the held-out Net3 evaluation and scenario-only baselines. The held-out discrimination comparisons, including the adjusted Net3 analysis, Table 3: Completed transfer evaluation on compromised trials. F1 uses a fixed 0.5 cutoff.

Train → test midrule A → B A→B B→A B→A A+B → Net3 A+B → Net3 A+B → Net3 A+B → Net3

Model Combined Scenario-only Combined Scenario-only Combined Scenario-only Security-only Hydraulic-only

n 185 185 217 217 247 247 247 247

ROC-AUC .791 .681 .815 .707 .772 .661 .670 .522

PR-AUC .770 .578 .780 .622 .775 .642 .686 .581

F1 .688 .689 .735 .746 .733 .704 .696 .714

are visualized in Fig. 2. The combined model improves Net3 ROC-AUC over scenario-only by 0.112 (95% configuration-cluster bootstrap CI 0.038–0.183) and PR-AUC by 0.134 (CI 0.067–0.206). Its F1 improvement is 0.029, but the 10

1.0

ROC AUC

0.8 0.6 0.4 0.2 0.0

Combined Scenario-only A B

B A

A+B Net3

Adjusted Net3

Figure 2: Held-out-network discrimination for combined and scenario-only models. The adjusted Net3 evaluation uses revised physical-impact labels.

bootstrap interval (−0.087 to 0.121) crosses zero. A → B and B → A exhibit ROC-AUC improvements of approximately 0.109 and 0.108, respectively. These outcomes address RQ1 and RQ2 within the synthetic setting, while the lack of F1 separation cautions against universal superiority claims. 4.2. Held-out Net3 confusion matrix The held-out Net3 confusion matrix is presented in Table 4. Among the 247 initially compromised trials, the combined model correctly identified 99 of 137 physical-impact cases and 76 of 110 non-impact cases. It produced 34 false positives and 38 false negatives, corresponding to a precision of 0.744, recall of 0.723, and F1-score of 0.733. Table 4: Confusion matrix for the combined model on the held-out Net3 dataset, conditional on initial compromise (n = 247).

Actual class

Predicted class

Total

Negative

Positive

Negative Positive

76 38

34 99

110 137

Total

114

133

247

4.3. Security-gap weighting sensitivity The ACGI weighting experiment evaluates equal weighting, five single-dimensiondominant schemes (weight 0.5 on one gap and 0.125 on each remaining gap), and five leave-one-dimension-out schemes (weight zero on one gap and 0.25 on each remaining gap). The following values summarize the mean ROC–AUC over the five saved source-network folds; they are not a held-out Net3 comparison, and fold means are descriptive rather than independent confidence intervals. 11

Table 5 reports the descriptive source-fold ROC–AUC results under alternative gap-weighting schemes. The weighting exercise is a robustness probe of a conTable 5: ACGI weighting sensitivity: mean ROC–AUC across five source folds.

Weight scheme

Mean ROC–AUC

segmentation gap dominant without access gap without exposure gap without detection gap equal without recovery gap recovery gap dominant access gap dominant without segmentation gap exposure gap dominant detection gap dominant

0.801 0.746 0.731 0.727 0.707 0.694 0.687 0.673 0.671 0.656 0.655

structed index; it cannot establish that any weight vector is an unbiased measure of real-world protection. For deployment, control criticality and context would require independent calibration. 4.4. Hydraulic feasibility and label stability At the original operating point, all 720 Net3 baselines had a monitored service-pressure minimum below 5 m. Excluding junction 10 alone did not change any of 720 impact labels, but did not repair that pressure shortfall. A demand-reduction pilot found no feasible factor in 264 evaluations. An initial Tank 1 level increase of 4 m yielded baseline service-pressure feasibility in 720/720 reruns, with zero recorded tank-bound violations. Positive labels decreased from 137 to 134: 717/720 (99.58%) remained unchanged. The three positive-to-negative changes all occurred in the pipe-isolation proxy; the other five scenarios preserved their labels. Configuration-bootstrap disagreement-rate 95% CI was 0–0.97%. Figure 3 shows the scenario-level distribution of labels before and after the operating-point adjustment. This addresses RQ3 only for the declared 5 m, five-minute-sampled, 91-junction feasibility criterion. 4.5. Frozen-model operating-point sensitivity Table 6 compares the frozen source-trained models at the original and adjusted Net3 operating points. Adjusted combined versus scenario-only ROCAUC difference is 0.111 (95% CI 0.036–0.182), and PR-AUC difference is 0.136 (CI 0.067–0.210). Changing only the mean tank-level input while retaining original labels leaves ROC-AUC and PR-AUC unchanged; the adjusted-label evaluation accounts for the observed discrimination difference. We therefore do not attribute the AUC improvement to tank adjustment alone.

12

Original Adjusted

Physical-impact trials

30 25 20 15 10 5 0

command replay

plc setpoint

pump override

remote access

sensor spoof

valve manipulation

Figure 3: Net3 scenario-level physical-impact labels before and after the operating-point change (120 trials per scenario). The three changes are confined to the pipe-isolation proxy.

Table 6: Original and adjusted Net3 transfer; source-only models, no target tuning.

Operating point midrule Original Adjusted Adjusted Adjusted Adjusted

Model Combined Combined Scenario-only Security-only Hydraulic-only

ROC-AUC .772 .791 .680 .666 .508

PR-AUC .775 .779 .643 .672 .561

F1 .733 .744 .711 .689 .703

Brier .191 .179 .198 .233 .249

4.6. Trial provenance and reproducibility controls The Stage 5.7 manifest records SHA-256 hashes for all three source/target trial tables, the adjusted hydraulic trial table, and the original reference predictions. The source-only reconstruction matches the original four models to floating-point precision (maximum absolute difference 1.11 × 10−16 ). In the sensitivity experiment, the only changed pre-attack hydraulic feature is mean initial tank level, increased by 4/3 m; security gaps, scenario identities, and other pre-attack features are unchanged. The 3,000 configuration-cluster bootstrap replicates are conditional on the reconstructed models. Data-generation code, trial CSVs, configuration IDs, model reconstruction and operating-point manifests should accompany the submission in a versioned archive. 4.7. Original-testbed parameter provenance, decoupling, and sensitivity The originally submitted 720-trial single-tank experiment is retained as a methodological diagnostic rather than independent validation. Inspection of the released simulator’s security.py and experiment.py shows that five fixed gap scores define the ACGI, whereas distinct, configuration-assigned Bernoulli blocking probabilities determine remote-access, lateral-movement, controller-access, and controller-integrity outcomes. The gap scores are not directly converted to blocking probabilities by an estimated function. Instead, both are assigned together to four cumulative, deliberately ordered configurations. These values

13

were illustrative design assumptions, not elicited from operators, measured at utilities, or calibrated from incident data. Consequently, an observed ACGI– CPPR correlation cannot be presented as independent predictive or causal validation. The complete configuration-specific security-stage assumptions are reported in Table 7; these values are simulation inputs, not field-calibrated estimates. Table 7: Original testbed’s complete assumed security-stage parameters; probabilities are configuration inputs, not empirical estimates. Config. C0 C1 C2 C3

Auth block

Lateral block

Controller block

Integrity block

Recovery eff.

Cyber det.

Process det.

.10 .68 .76 .84

.10 .18 .78 .88

.08 .15 .62 .82

.05 .10 .30 .82

.25 .35 .50 .82

.30 .50 .64 .78

.20 .30 .42 .90

For each attack scenario, the needs_remote_access, needs_lateral_movement, and needs_controller_access Boolean flags determine which Bernoulli blocking gates apply in sequence. A failed remote-access gate prevents initial compromise; a failed lateral gate prevents OT reach; a failed controller gate prevents controller access. The integrity gate applies only to persistent threshold modification. Detection can probabilistically trigger containment through recovery_efficiency; the process-detection strength is used in scoring, not as a direct independent hydraulic failure probability. The original binary physicalimpact criterion was controller access and a maximum attacked-versus-counterfactual normalized tank-level difference of at least 0.08. The 0.08 value is a dimensionless exploratory cutoff, not a physical pressure standard or field-calibrated safety threshold. This single-tank criterion differs from the later Net3 pressure/tanklevel thresholds, which must not be conflated. Table 8 presents the recomputed CPPR under alternative normalized physicalimpact thresholds. Table 8: Recomputed CPPR from the original 720 saved trial trajectories at alternative normalized tank-level impact thresholds. Denominators remain 176, 161, 161, and 157 initial compromises for C0–C3.

Threshold

C0

C1

C2

C3

0.04 0.06 0.08 (original) 0.10 0.12

.864 .847 .784 .761 .744

.640 .615 .540 .497 .484

.118 .118 .118 .106 .081

.051 .051 .051 .045 .032

The threshold sweep reclassifies saved trajectories without changing the process or attack-generation mechanism. Reclassification at 0.08 reproduces all original labels. The rank order C0>C1>C2>C3 persists throughout the explored threshold range, but the absolute rates are threshold-dependent. Table 9 reports the effects of multiplicative perturbations to the original simulator’s stage-blocking probabilities. 14

Table 9: Rerun CPPR after multiplicative perturbation of the four stage-blocking probabilities in the original simulator (common trial seeds; probabilities clipped to [0,1]). Recovery and detector settings are held fixed.

Blocking-probability multiplier

C0

C1

C2

C3

0.8 1.0 (original) 1.2

.795 .784 .778

.617 .540 .503

.220 .118 .065

.110 .051 .007

This is a local sensitivity analysis, not an uncertainty distribution for realworld controls. Each multiplier was applied to auth_block_prob, lateral_block_prob, controller_block_prob, and integrity_block_prob in every configuration, with original trial seeds and all other settings unchanged. Because branching consumes random draws conditionally, reruns preserve seeds but do not guarantee identical subsequent random-number streams. Rankings remain ordered in these three runs, although the C3 rate varies substantially. Weighting and decoupling diagnostic.. We additionally sampled 10,000 nonnegative ACGI weight vectors from a five-dimensional Dirichlet(1) distribution (seed 2026) and examined five leave-one-dimension-out averages. Every sampled weight vector preserves the original configuration ordering, because each of the five assigned gap dimensions decreases monotonically from C0 through C3. This apparent weight robustness is therefore a mathematical property of the designed configuration table, not empirical validation of the weights. To expose this dependence, we also assigned 10,000 independently sampled fivecomponent gap-score vectors to the four fixed outcome configurations without altering their blocking probabilities. The mean Spearman correlation between the independently assigned index and the four original CPPR values was approximately −0.012, compared with 1.0 for the original ordered assignments. This is a negative-control diagnostic: randomly assigned gaps have no reason to predict cyber outcomes. It does not establish that random gaps are a realistic assessment instrument or that any decoupled index has been validated. A valid external ACGI calibration requires measured control evidence independently collected from the attack-outcome generation process. 5. Discussion and threats to validity Interpretation.. The three-network experiments provide executed evidence that pre-attack security gaps and scenario context can discriminate a synthetically generated physical-propagation outcome on held-out hydraulic networks. The combined model’s positive AUC advantage persists under the adjusted Net3 operating point. CPPR is conditional on initial compromise; it is not the probability of attack initiation or an unconditional estimate of utility failure. ACGI provides a transparent summary of specified controls, but its equal weights are design assumptions rather than empirically calibrated contributions.

15

Circularity and construct validity.. Initial compromise and OT reach are explicitly driven by simulated security-gap rules. A predictor receiving those gaps can learn part of the outcome-generating mechanism. Consequently, high transfer AUC is evidence of consistency across these synthetic environments, not independent confirmation of the causal value of the controls. Likewise, a processaware detector evaluated against labels defined by process deviation can be circular. For this reason, prior detector precision/recall figures are not promoted as an independently validated detection contribution in this revision; any detector study would require independently labeled events and a separate detection benchmark. Hydraulic validity.. Net3 supplies actual pipe/pump/tank topology rather than a single normalized storage equation, addressing a major earlier omission. Nevertheless, WNTR demand-driven simulation is not a field instrument; the 5 m threshold is exploratory; discrete reports can miss intermediate extrema; the pump-adjacent junction 10 is excluded from the service-pressure criterion; and some attack labels use pump-status or pipe-isolation proxies. The chosen +4 m initial level is a bounded operating-point sensitivity, not a validated operational intervention for a real utility. Expert assessment and operational applicability.. The framework’s five gap dimensions and their equal-weight index have not been independently elicited or validated through structured interviews with utility operators, OT engineers, or water-sector cybersecurity specialists. The experiments therefore cannot establish practitioner agreement on dimension selection, weighting, the realism of attack-stage probabilities, or deployment feasibility. Expert interviews or a documented structured elicitation study are a distinct validation requirement, not a substitute for hydraulic simulation. Such an assessment should recruit participants with complementary water-operations and OT-security expertise, use a consistent protocol to evaluate control observability and scoring, and report disagreement and sensitivity of ACGI rankings to elicited weights. No expert interviews are claimed in the present study. External validation and benchmarking.. A, B, and Net3 are different simulated hydraulic networks, not three independent real utilities. The study does not implement recent competing cyber-to-physical predictors on an identical datagenerating protocol; its fair same-task comparisons are limited to internal ablations. External testing on measured SCADA telemetry, a physical or hardwarein-the-loop water testbed, independently specified cyber compromise events, and broader hydraulic solvers is required before deployment or SOTA claims. Bootstrap intervals resample 40 Net3 configurations conditional on a fitted model and should not be interpreted as uncertainty over utilities. 6. Conclusion We presented an experimental framework linking the Applied Cybersecurity Gap Index (ACGI) to the Cyber-to-Physical Propagation Rate (CPPR), 16

defined conditionally on initial cyber compromise. The evaluation comprised 2,160 synthetic trials across three networks. On held-out Net3, 137 of 247 initially compromised trials produced physical-impact labels (CPPR 55.5%). A source-trained predictor achieved ROC-AUC 0.772 and PR-AUC 0.775, versus 0.661 and 0.642 for a scenario-only comparator; the configuration-bootstrap interval for the ROC-AUC difference was 0.038–0.183. A separate 720-run Net3 operating-point test satisfied the exploratory baseline pressure screen, preserved 717 impact labels, and yielded ROC-AUC 0.791 for the frozen predictor. The sensitivity and decoupling analyses demonstrate that the observed ACGI– CPPR relationship is partly imposed by the security-dependent simulator, and that propagation estimates depend on the assumed blocking probabilities and physical-impact threshold. These results support a reproducible simulationbased assessment protocol, not a field-calibrated risk score, causal control-effectiveness estimate, or real-utility failure forecast. Future validation requires independent cyber events, utility or hardware-in-the-loop measurements, practitioner assessment, and broader hydraulic operating conditions. Funding This research received no external funding. Declaration of competing interest The authors declare no competing interests. CRediT authorship contribution statement Halil I. Dursunoglu: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Data curation, Writing–original draft, Writing–review & editing, Visualization, Project administration. Kaan Sulkalar: Conceptualization, Validation, Resources, Writing–review & editing. Ethics statement This study used an isolated software-based cyber-physical simulation and did not involve human participants, animals, or interaction with production criticalinfrastructure systems. Institutional review board approval was therefore not required. Data and code availability Trial CSVs, simulator scripts, configuration manifests, and frozen-model verification outputs were generated for this study. The associated research archive is identified by DOI https://doi.org/10.5281/zenodo.23269487. Authors should verify that the deposited release includes the files needed to reproduce each reported analysis. 17

References [1] K. Stouffer, M. Pease, C. Tang, T. Zimmerman, V. Pillitteri, S. Lightman, A. Hahn, S. Saravia, A. Sherule, M. Thompson, Guide to Operational Technology (OT) Security, NIST Special Publication 800-82 Revision 3, National Institute of Standards and Technology, 2023. https://doi.org/ 10.6028/NIST.SP.800-82r3. [2] C. Pascoe, S. Quinn, K. Scarfone, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, National Institute of Standards and Technology, 2024. https://doi.org/10.6028/NIST.CSWP.29. [3] S. Adepu, A. Mathur, Using process invariants to detect cyber attacks on a water treatment system, in: ICT Systems Security and Privacy Protection, Springer, 2016. [4] C.M. Ahmed, V.R. Palleti, A.P. Mathur, WADI: A water distribution testbed for research in the design of secure cyber physical systems, in: International Workshop on Cyber-Physical Systems for Smart Water Networks, 2017. [5] J. Inoue, Y. Yamagata, Y. Chen, C.M. Poskitt, J. Sun, Anomaly detection for a water treatment system using unsupervised machine learning, in: 2017 IEEE International Conference on Data Mining Workshops (ICDMW), 2017. [6] R. Taormina, S. Galelli, N.O. Tippenhauer, E. Salomons, A. Ostfeld, Battle of the attack detection algorithms: Disclosing cyber attacks on water distribution networks, J. Water Resour. Plan. Manag. 144 (8) (2018) 04018048. https://doi.org/10.1061/(ASCE)WR.1943-5452.0000969. [7] M. Housh, Z. Ohar, Model-based approach for cyber-physical attack detection in water distribution systems, Water Research 139 (2018) 132–143. https://doi.org/10.1016/j.watres.2018.03.039. [8] U. Parajuli, S. Shin, Identifying failure types in cyber-physical water distribution networks using machine learning models, AQUA–Water Infrastructure, Ecosystems and Society 73 (3) (2024) 504–519. https://doi.org/ 10.2166/aqua.2024.264. [9] P. Pandey, N.T. Muecke, S. Jain, P. Ramachandran, S.M. Bohte, C.W. Oosterlee, Machine Learning-Based Digital Twin for Water Distribution Network Anomaly Detection and Localization, Engineering Proceedings 69 (2024) 201. https://doi.org/10.3390/engproc2024069201. [10] N. Raza, F. Moazeni, Optimal cybersecurity framework for smart water system: Detection, localization and severity assessment, Water Research 281 (2025) 123517. https://doi.org/10.1016/j.watres.2025.123517.

18

[11] M. Homaei, M. Tarif, P. Garcia Rodriguez, A. Caro, M. Avila, Causal Digital Twins for cyber–physical security in water systems: A framework for robust anomaly detection, Machine Learning with Applications 23 (2026) 100824. https://doi.org/10.1016/j.mlwa.2025.100824. [12] M.A. Habib, A.D. Jurcut, H. Ahmed, W. Wei, M. Salauddin, Cybersecurity in Water Distribution Networks: A Systematic Review of AI-Based Detection Algorithms, Water 18 (4) (2026) 519. https://www.mdpi.com/ 2073-4441/18/4/519. [13] Breaking the flow and the bank: Stealthy cyberattacks on water network hydraulics, Water Research 283 (2025) 123719. https://doi.org/ 10.1016/j.watres.2025.123719. [14] N. Tuptuk, P. Hazell, J. Watson, S. Hailes, A systematic review of the state of cyber-security in water systems, Water 13 (1) (2021) 81. https: //doi.org/10.3390/w13010081. [15] D. Wang, Y. Song, S. Xiao, Output-constrained secure sliding mode control of coagulation process in drinking water treatment under cyber attacks, IEEE Transactions on Industrial Electronics 73 (6) (2026) 9221–9232. https://doi.org/10.1109/TIE.2025.3649872. [16] F. Voggensberger, J.H. Schmidt, V. Mattos, G. Srivastava, D.S. Menasché, A. Bhaya, A.O. de Sá, A.W. Miranda, A context-aware cybersecurity assessment methodology for industrial control systems in the water industry, in: S. Zonouz, D. Mashima, A. Mathur, J. Zhou (Eds.), Design of Cyber-Secure Critical Infrastructure, Communications in Computer and Information Science 3109, Springer, 2027, pp. 214–235. https: //doi.org/10.1007/978-981-92-5039-4_11. [17] Q. Gulzar, K. Mustafa, An analytical survey of cyber-physical systems in water treatment and distribution: Security challenges, intrusion detection, and future directions, Security and Privacy 7 (6) (2024) e440. https:// doi.org/10.1002/spy2.440. [18] C.-Y. Lin, Y.-C. E. Yang, F. Moazeni, Flood Risks of Cyber-Physical Attacks in a Smart Storm Water System, Water Resources Research 60 (1) (2024) e2023WR034827. https://doi.org/10.1029/2023WR034827. [19] Cyber–Physical Attack Detection in Water Distribution Systems with Temporal Graph Convolutional Neural Networks, Water 13 (9) (2021) 1247. https://www.mdpi.com/2073-4441/13/9/1247. [20] P. Chandran, K.S. Sunil, Safeguarding water distribution systems: Cyberphysical attack detection using rectilinear hybrid belief classifier network, Journal of Water Process Engineering 76 (2025) 108131. https://doi. org/10.1016/j.jwpe.2025.108131.

19

[21] L.A. Rossman, H. Woo, M. Tryby, F. Shang, R. Janke, T. Haxton, EPANET 2.2 User Manual, EPA/600/R-20/133, U.S. Environmental Protection Agency, 2020. https://cfpub.epa.gov/si/si_public_record_ Report.cfm?LAB=CESER&dirEntryID=348882. [22] K. Klise, D. Hart, M. Bynum, J. Hogge, T. Haxton, R. Murray, J. Burkhardt, Water Network Tool for Resilience (WNTR) User Manual Version 1.0, EPA/600/B-23/098, U.S. Environmental Protection Agency, 2023. https://usepa.github.io/WNTR/. [23] K.A. Klise, M. Bynum, D. Moriarty, R. Murray, A software framework for assessing the resilience of drinking water systems to disasters with an example earthquake case study, Environmental Modelling and Software 95 (2017) 420–431. https://doi.org/10.1016/j.envsoft.2017.06.022. [24] B. Duan, J. Gao, H. Cao, S. Hu, Energy-Efficient Management of Urban Water Distribution Networks Under Hydraulic Anomalies: A Review of Technologies and Challenges, Energies 18 (11) (2025) 2877. https://doi. org/10.3390/en18112877. [25] TwinAI: A digital twin and graph reinforcement learning framework for real-time management of water distribution networks, Internet of Things (2026), Article 101911. https://doi.org/10.1016/j.iot.2026.101911. [26] T. Saito, M. Rehmsmeier, The Precision-Recall Plot Is More Informative than the ROC Plot When Evaluating Binary Classifiers on Imbalanced Datasets, PLOS ONE 10 (3) (2015) e0118432. https://doi.org/10.1371/ journal.pone.0118432. [27] F. Pedregosa, G. Varoquaux, A. Gramfort, et al., Scikit-learn: Machine Learning in Python, Journal of Machine Learning Research 12 (2011) 2825– 2830. https://www.jmlr.org/papers/v12/pedregosa11a.html.

20

Related documents

• 42 U.S.C. § 300g-10 — Cybersecurity support for public water systems#594835
• A FRAMEWORK FOR DATASET GENERATION, ANOMALY DETECTION AND CYBERSECURITY IN INDUSTRIAL CYBER-PHYSICAL SYSTEMS#1040857
• A Roadmap to Available ICS Datasets and Testbeds for Cybersecurity Research#799544
• A Roadmap to Available ICS Datasets and Testbeds for Cybersecurity Research#798121
• A Review of Cybersecurity Incidents in the Water Sector#631413