Published Paper Details:

Supervisory Control and Data Acquisition (SCADA) water-treatment plants manage chemical dosing, pH and chlorine levels, and pumping operations, but increasing connectivity has exposed them to cyber risks such as unauthorized access, insider tampering, falsified sensor data, and malicious PLC commands. These attacks can silently alter treatment parameters and disrupt operations while appearing normal. Traditional SCADA security methods based on thresholds and signatures often miss slow, evolving attacks and still expose raw operational data, creating both security and privacy risks. This project proposes an intrusion detection framework that leverages a Temporal Convolutional Network (TCN) autoencoder to learn normal operating patterns across SCADA signals that are commonly targeted by Cyber-Physical Process Manipulation Attacks, including chemical dosing, pH and chlorine behavior, pump and tank dynamics, network activity, user interactions, and PLC control operations. The system learns normal plant behavior over time and automatically detects unusual changes that may indicate an attack, without needing predefined attack rules. Believable sensor readings and PLC responses are generated so that malicious commands only affect the virtual system, while the actual plant remains fully protected. This detection-then-protection strategy ensures service continuity, prevents physical damage, enables attacker behavior analysis, and significantly reduces operational risk in modern water-treatment facilities.