Abstract
As Water distribution infrastructures are ageing, their modernization process is leading to an increased incorporation of connected devices into these physical systems. This transition is changing the nature of water distribution control systems from physical systems to cyber-physical systems (CPS). However, this evolution is associated with an increased vulnerability to cyber-attacks. Detecting such attacks in CPS is gaining traction in the scientific community with the recent release of cyber-physical datasets that capture simultaneously the network traffic and the physical state of a water distribution testbed. This novel paradigm of conjoint availability of these two types of data from a common source infrastructure opens a new question on how to combine their information when training machine learning models for attack detection. As an alternative approach to previous models that rely on model aggregation, this paper introduces Multi-Layer Concatenation, a combination scheme to merge the information from the physical and network parts of a CPS from a data perspective, through a time-based join operation coupled with a propagation process to keep the coherence of the global system. The evaluation of its impact assesses its benefits for machine learning-based detection on three cyber-physical datasets, by measuring machine learning models’ performances on physical and network data separately, and then on data combined through the proposed scheme.