DeepH2O

        <h5><i class="fas fa-calculator"></i> TGCN Formulation</h5>
        <p>The TGCN update rule combines spatial and temporal convolutions:</p>

        <p>Where $\tilde{A}$ represents the normalized adjacency matrix encoding sensor network topology.</p>
      </div>
    </div>
  </div>
  <div class="col-lg-4">
    <div class="results-summary">
      <h4>TGCN Performance</h4>
      <div class="metric-item">
        <span class="metric-label">Spatial Accuracy:</span>
        <span class="metric-value">96.8%</span>
      </div>
      <div class="metric-item">
        <span class="metric-label">Temporal Precision:</span>
        <span class="metric-value">94.5%</span>
      </div>
      <div class="metric-item">
        <span class="metric-label">Processing Speed:</span>
        <span class="metric-value">12ms</span>
      </div>
      <div class="metric-item">
        <span class="metric-label">Network Nodes:</span>
        <span class="metric-value">250 sensors</span>
      </div>
    </div>
  </div>
</div>

Experimental Results

Figure 1: Comprehensive DeepH2O framework showing the integration of HCAE and TGCN for robust cyber-attack detection in water distribution systems with minimal false positives.

HCAE addresses the variability found in standard AutoEncoders, where the reconstruction error can vary due to randomness in the training process. By improving this consistency, HCAE enhances attack detection performance, reducing both false positives and false negatives.

AI Assurance Constraints in HCAE

Four constraints are applied to the HCAE to ensure more accurate feature learning:

1. Tied Weights: Ensures the weights of the encoder and decoder are tied, reducing the number of parameters and promoting a PCA-like dimensionality reduction.
2. Orthogonal Weights: Regularizes the model by enforcing that the weight vectors in the encoding layer are orthogonal, helping the model capture independent features.
3. Uncorrelated Features: Ensures that the output of the encoder is uncorrelated, preventing redundant feature learning and improving generalization.
4. Unit Norm: Applies a unit norm constraint to all layers, addressing issues like exploding and vanishing gradients during training.

By incorporating these constraints, HCAE provides a more reliable and robust attack detection mechanism, as shown in Figure 1 below:

Figure 1: Fully Connected ANN-based Autoencoder for WDS

Attack Detection Workflow in HCAE

The HCAE model's workflow involves two key stages: model development and attack detection. The model is trained on normal WDS data, with reconstruction errors minimized during training using the Adam optimizer. Once trained, the model detects anomalies in new data based on reconstruction errors that exceed a threshold, $\theta_{th}$, determined empirically.

Figure 2: HCAE Model Development and Attack Detection Workflow

The threshold $\theta_{th}$ is calibrated based on the training dataset's error distribution, allowing the model to classify whether a system is under attack or operating normally.

Temporal Graph Convolutional Networks (TGCN)

While HCAE captures spatial correlations between different sensors, TGCN focuses on temporal patterns in WDS sensor data. WDS operate over time, and sensor readings at one moment can be highly correlated with previous readings.

TGCN integrates graph-based learning with recurrent neural networks (RNNs) to capture both spatial and temporal dependencies. By modeling the WDS as a graph where each node represents a sensor, and edges represent their interactions, TGCN is able to detect anomalies that emerge over time, such as gradual system failures or coordinated cyber-attacks.

Synthetic Data Generation with GANs

To test the generalizability of HCAE and TGCN, Generative Adversarial Networks (GANs) are used to generate synthetic attack data. GANs can learn from the statistical properties of normal WDS data and generate realistic “poisoned” data representing cyber-attacks. The adversarial testing phase ensures that the model can handle previously unseen data distributions, as is often the case in real-world cyber-attack scenarios.

GAN training follows a minimax optimization process, where a generator tries to fool a discriminator into classifying synthetic data as real. The objective function for GANs is given as:

Through this process, the model is tested on both real and adversarially generated attack data, further improving robustness.

Conclusion

DeepH2O provides a comprehensive and advanced solution for detecting cyber-attacks in WDS. By integrating HCAE for spatial anomaly detection and TGCN for temporal anomaly detection, and further testing with synthetic data generated by GANs, the system ensures reliable performance with low false positive rates. This innovative framework is vital for safeguarding critical infrastructure, where maintenance and response costs are high.