ResAttn-CPS: Deep Residual Attention Autoencoders for Water Infrastructure Security

Author : Anwar Tarawneh, Mohammad Z. Masoud

Abstract : Multivariate time-series anomaly detection in critical water infrastructure requires both robust feature representation and adaptive thresholding to suppress false alarms while detecting subtle attacks. In this work, we present a Residual-Attention Autoencoder framework engineered for cyber-physical (ResAttn-CPS) attack detection on the WADI benchmark dataset (784,571 training instances across 130 sensor features). To isolate targeted attack signals from multi-sensor background noise, ResAttn-CPS combines feature-velocity fusion [X,\ΔX], 1D residual connections, channel self-attention and a Top-K sparse reconstruction loss (K=15%). A comparative evaluation of three thresholding strategies across the WADI test set, static Median Absolute Deviation (MAD), dynamic Exponentially Weighted Moving Average (EWMA) and dynamic rolling quantiles 5% has been conducted. Results demonstrate that threshold selection dictates system viability: static MAD achieves high recall 95.69% but poor precision (peak F1=0.3028), while EWMA over-adapts to persistent anomalies (F1=0.2122). The Dynamic Rolling Quantile 5% approach achieves the superior overall trade-off, reaching a peak F1-score of 0.6664 at multiplier k=4.0. These findings highlight the critical role of adaptive, quantile-based sliding windows in كسافا suppressing non-stationary operational noise in complex industrial control systems

Keywords : Anomaly Detection, Water Distribution (WADI) Network, Autoencoder, Security Attacks, Industrial Internet of Things (IIoT)

Conference Name : International Conference on Cybersecurity and Artificial Intelligence (ICCAI - 26)

Conference Place : Malaga, Spain

Conference Date : 11th Sep 2026