An Investigation into the Response of a Water Treatment System to Cyber Attacks

An experimental investigation was undertaken to understand the impact of single-point cyber attacks on a Secure Water Treatment (SWaT) system. Cyber attacks were launched on SWaT through its SCADA server that connects to the Programmable Logic Controllers (PLCs) that in turn are connected to sensors and actuators. Attacks were designed to meet attacker objectives selected from a novel attacker model. Outcome of the experiments led to a better understanding of (a) the propagation of an attack across the system measured in terms of the number of components affected and (b) the behavior of the water treatment process in SWaT in response to the attacks. The observed response to various attacks was then used to propose attack detection mechanisms based on various physical properties measured during the treatment process.