RESATTN-CPS: Deep Residual Attention Autoencoders For Water Infrastructure Security

Abstract

Multivariate time-series anomaly detection in critical water infrastructure requires both robust feature representation and adaptive thresholding to suppress false alarms while detecting subtle attacks. In this work, we present a Residual-Attention Autoencoder framework engineered for cyber-physical (ResAttn-CPS) attack detection on the WADI benchmark dataset (784,571 training instances across 130 sensor features). To isolate targeted attack signals from multi-sensor background noise, ResAttn-CPS combines feature-velocity fusion [X,\ΔX], 1D residual connections, channel self-attention and a Top-K sparse reconstruction loss (K=15%). A comparative evaluation of three thresholding strategies across the WADI test set, static Median Absolute Deviation (MAD), dynamic Exponentially Weighted Moving Average (EWMA) and dynamic rolling quantiles 5% has been conducted. Results demonstrate that threshold selection dictates system viability: static MAD achieves high recall 95.69% but poor precision (peak F1 = 0.3028), while EWMA over-adapts to persistent anomalies (F1 = 0.2122). The Dynamic Rolling Quantile 5% approach achieves the superior overall trade-off, reaching a peak F1-score of 0.6664 at multiplier k=4.0. These findings highlight the critical role of adaptive, quantile-based sliding windows in suppressing non-stationary operational noise in complex industrial control systems.