Training-free model speeds cyberattack and fault detection in water networks
HydroJEV: A one-second, training-free screen for cyber-attack and fault attribution in water distribution networks
Artificial Intelligence
Summary
Water network operators receive many alarms that could signal cyberattacks, equipment faults, or sensor errors, and they need to decide quickly what is happening. The authors evaluated a model called Jev that does not need training data and gives results in about one second. Jev performed as well or better than existing methods, including some that require training or take longer, especially when there are few examples of past incidents. Using Jev as a first step can reduce the workload for human reviewers without losing accuracy.
What this means in practice
- •For water utility operators: Automatically screen SCADA alarms in seconds to flag potential cyberattacks or faults without needing past labeled incidents.
- •For industrial monitoring teams: Integrate a rapid, training-free model to reduce manual review workloads while maintaining accuracy in complex sensor networks.
Authors
Tianwei Mu, Shengyan Jiang, Mingzhe Yuan, Qing Luo, Min Xiao, Wenhong Wang, Jun Li, Manhong Huang
Abstract
When a SCADA alarm is raised in a water distribution network, operators must decide quickly whether it reflects a cyberattack, a physical fault, a normal transient or a faulty sensor. Supervised classifiers need labelled incidents that utilities rarely have, and frontier large language models (LLMs) take tens of seconds per decision. We tested whether Jev, a training-free model that returns class probabilities in about one second, can serve as the first tier of this triage. On a four-class cause-attribution benchmark built on the C-Town network in EPANET, Jev was compared with a hand-written rule tree, a supervised classifier and seven cloud LLMs on identical evidence in four sealed, pre-registered rounds. With only a label-free prior correction, Jev matched the rule tree (macro-F1 0.62-0.64 against 0.56-0.61 in distribution) and exceeded the supervised classifier by 0.36-0.42 on event subtypes absent from its labels, in all four rounds, and it outperformed the classifier whenever fewer than about four labelled events per class were available. Jev also decided 20-40 times faster than frontier LLMs. Accepting only benign Jev verdicts confirmed by the rule tree spared an LLM reviewer 35-38% of windows on fresh sealed sets without loss of macro-F1. Transferred unchanged to two further networks, this gated cascade stayed within the non-inferiority margin of its reviewer on all four sets. A fast, training-free screen can therefore take over about a third of the review load in SCADA anomaly triage while preserving the accuracy of deliberate review.