  While Water Treatment Networks (WTNs) are critical infrastructures for local
communities and public health, WTNs are vulnerable to cyber attacks. Effective
detection of attacks can defend WTNs against discharging contaminated water,
denying access, destroying equipment, and causing public fear. While there are
extensive studies in WTNs attack detection, they only exploit the data
characteristics partially to detect cyber attacks. After preliminary exploring
the sensing data of WTNs, we find that integrating spatio-temporal knowledge,
representation learning, and detection algorithms can improve attack detection
accuracy. To this end, we propose a structured anomaly detection framework to
defend WTNs by modeling the spatio-temporal characteristics of cyber attacks in
WTNs. In particular, we propose a spatio-temporal representation framework
specially tailored to cyber attacks after separating the sensing data of WTNs
into a sequence of time segments. This framework has two key components. The
first component is a temporal embedding module to preserve temporal patterns
within a time segment by projecting the time segment of a sensor into a
temporal embedding vector. We then construct Spatio-Temporal Graphs (STGs),
where a node is a sensor and an attribute is the temporal embedding vector of
the sensor, to describe the state of the WTNs. The second component is a
spatial embedding module, which learns the final fused embedding of the WTNs
from STGs. In addition, we devise an improved one class-SVM model that utilizes
a new designed pairwise kernel to detect cyber attacks. The devised pairwise
kernel augments the distance between normal and attack patterns in the fused
embedding space. Finally, we conducted extensive experimental evaluations with
real-world data to demonstrate the effectiveness of our framework.
