Assessing Cyber-Physical Threats under Water Demand Uncertainty ^†

Abstract

This study presents an approach for the assessment of cyber-physical threats to water distribution networks under the prism of the uncertainty which stems from the variability and stochastic nature of nodal water demands. The proposed framework investigates a single threat scenario under a spectrum of synthetic, yet realistic, system states which are driven by an ensemble of stochastically generated nodal demands. This Monte Carlo-type experiment enables the probabilistic inference about model outputs, and hence the derivation of probabilistic estimates over consequences. The approach is showcased for a cyber-physical attack scenario against the monitoring and control system of a benchmark network.

1. Introduction

Urban water systems, as many other critical infrastructures, are undergoing a digital transformation which, evidently, yields both merits and perils [1,2]. Their long-established modus operandi is reshaped by the dynamic interconnection of cyber and physical processes and assets—progressively moving towards a new, cyber-physical systems’ (CPS) architecture [3,4]. As recent incidents demonstrate [5], this increases the attack surface of the water systems and allows for emerging threats against the CPS, hindering the monitoring and control processes and compromising the integrity of the water supply—including potential weaponisation. As a result, traditional system thinking is challenged, while security planning becomes more intricate with the addition of a new component in risk assessment schemes, that of cyber-physical risks. The need for adjustment by the sector is reflected by an ever-increasing development of novel solutions, cyber-physical modelling platforms, techniques and frameworks to strengthen security and risk assessment at both conceptual and practical levels [6].

Contemporary risk assessment frame works for the water sector investigate the potential threats by adopting the typical scenario-based approach [7,8] to analyse, and subsequently evaluate the resulting failure through suitable metrics [9]. In the scenario-based approach, a set of external events drives a pre-defined system model to analyse risks—implying mutually that this model represents a usual state of the system. However, urban water systems are complex and dynamic in nature and can exhibit a notable variability in their behaviour, even under normal operating conditions. This poses questions on the representativeness of internal parameters that drive the system model, and hence the simulated outcomes, and the value of the resulting risk information, as uncertainty pertains the risk-relevant data from the deterministic model set-ups.

Uncertainty analysis has long been acknowledged as a pivotal concept for risk characterization [10], yet rarely addressed formally as a core component of risk assessment techniques or design practices. A paradigm shift is introduced formally by the International Organization for Standardization (ISO), which embeds the notion of uncertainty to the definition of risk, in reference to potential events and their consequences [11]. Moreover, in recent years, the appropriate characterization and handling of uncertainty is revisited, leading to the reshaping of traditional analytical tools [12] with the help of uncertainty propagation techniques. This includes stochastically-enhanced frameworks developed to systematically cope with uncertainties, inter alia in water pipe rehabilitation plans [13], flood defence infrastructure [14], long-term operation and resilience of urban water systems [15], etc. One such framework is also introduced for the assessment of cyber-physical risks against urban water systems [16] under the prism of, both epistemic and aleatory, uncertainties. An epistemic uncertainty, also known as systemic, is linked to the degree of factual knowledge (or lack thereof). On the other hand, an aleatory uncertainty refers to the inherent probabilistic variability of the underlying components.

This work focuses on the latter type, and specifically examines the assessment of cyber-physical threats under the uncertain and high variable nature of water demand, that is a key driver of urban water systems [17,18]. Specifically, we propose a framework that couples the sector’s scenario-based approaches with state-of-the-art stochastic simulation approaches [19,20,21] that allow to assess a single threat scenario under a spectrum of stochastically generated demands, in a Monte Carlo-type experiment. This formulation allows the inference about the model’s outputs, and related consequences, in probabilistic terms. The overall result is an uncertainty-informed, probabilistic estimation of the risk’s severity.

The remaining of the paper showcasing the proposed stochastic assessment framework is organized on the basis of a demo water distribution network (WDN). In more detail, Section 2.1 provides information about the case study per se, Section 2.2 entails the methodology for the stochastic simulation/generation of water demand time series and Section 2.3 details the generation of cyber-physical threat scenarios for a WDN. Section 3 discusses the approach employed for the probabilistic assessment of threat scenarios. Finally, Section 4 concludes this work through a summary of its main findings and conclusions.

2. Stochastic Risk Assessment for WDN

2.1. The C-Town Case Study

C-town is an EPANET demo WDN, based on a medium-sized real world network [22]. It is comprised of seven tanks, and five pumping stations with a total of 11 head pumps, which are used to store and regulate the water distribution to 388 consumption nodes. The WDN is supplied by a single source, the R1 seasonal reservoir, with an average hourly production of approximately 613.17 m³/h. The system is divided into five district metered areas (DMA), all of which include a pumping station and at least one tank in them, as illustrated in Figure 1. The fundamental C-Town operation mode draws water from R1 through the linked pumping station, according to the level of tank T1. In high water levels, only one pump draws water, and a second pump is activated for critically low levels. The pumping station also has a third, redundant pump placed in parallel. The flow from DMA1 to DMA2 is regulated with the use of two flow control valves that operate according to the T2 tank level, while two pressure regulating valves (PRV) are placed within DMA2. Water from T2 is pumped to the higher tanks, namely T3 and T4. The pumping stations of DMA4 and DMA5 pump water to tanks T5, T6 and T7 from DMA1 and T1. The pumping stations activation rules are based on the level sensors of their DMA tanks.

2.2. Generation of Synthetic Water Demand Series

In the design, analysis and management of urban water systems, the water demand, as a key driver of these systems, is analysed and modelled at different temporal and spatial levels, depending on the requirements and type of analysis under study. As the spatial and temporal resolution of the analysis is increasing, the level of uncertainty and randomness of the water demand increases too, posing extra challenges and difficulties. Specifically, at fine scales, water demand is characterised by intermittent behaviour (i.e., the presence of zero values in the series), deviation from Gaussianity, a variety of temporal and spatial dependence structures, and various types of seasonality [19]. The modelling of these peculiarities is feasible by studying the water demand on the basis of probabilistic notions and concepts, such as those of random variables and stochastic processes. This approach allows to generate a large number of synthetic, yet statistically and stochastically consistent, water demand timeseries that can be employed as non-deterministic inputs to provide the system’s responses under different scenarios—essentially, the approach adopted in this study.

Here, we treat as stochastic process the demand multiplier pattern used by the Epanet modelling approach to represent the variability of the customer’s (nodal’s) demand over time. The pattern is multiplied by a base demand assigned to each node in order to reproduce the actual size of the variability, along with the peak and minimum demand periods throughout the simulation horizon. The C-Town case study comes along with a set of five demand multiplier patterns (one for each DMA), with an hourly temporal resolution, that span over an entire week, to describe the overall system’s demand processes [22].

To generate synthetic water demand multiplier patterns, the anySim R package [20] was employed. This package provides state-of-the-art stochastic simulation methods that allow the exact preservation of any marginal distribution and any dependence structure of the stochastic processes under study [23,24,25]. In a nutshell, the method implemented herein is based on the coupling of Nataf’s joint distribution model (i.e., the Gaussian copula) with the widely known class of linear stochastic models. According to Nataf’s joint distribution model, the joint distribution of random variables with any target arbitrary marginal distributions can be obtained by mapping an auxiliary multivariate standard Gaussian distribution via the inverse cumulative distribution functions (ICDFs). The implemented methods utilize the link between correlation coefficients in the Gaussian and the target domain, also reproducing the target correlations. Moving to the stochastic process simulation, anySim employs a similar concept that is based on the mapping (through the ICDF) of an auxiliary Gaussian process (Gp) through the ICDF, to establish processes with the target marginal distribution and correlation structure. Specifically, herein we employed the Gamma distribution to model the marginal behaviour of the demand multiplier patterns of all five DMAs [26], while the classical autoregressive model (AR(p)) was employed as an underlying linear model to reproduce the auto-correlation structure of each pattern and the lag-0 cross-correlation between the patterns. To cope with seasonality, the given hourly demand multiplier patterns were first standardised over the mean, and hence the stochastic simulation was performed under the assumption of stationarity. The generated series were de-transformed via the inverse procedure to formulate the synthetic seasonally varying series that were used as inputs in EPANET.

Water demand series and their stochasticity have a significant influence over the dynamics of water systems in both short- (including instantaneous) and long-term horizons. Thus, despite the original pattern series having a 1-week duration, this work expands their duration to 2 weeks. This enables the full development of stochasticity in the system states under which the potential attack takes place (in the first week) and monitors the system’s behaviour after the attack (during the second week) for any cascading effect of the cyber-physical threat.

Thus, the overall result of this step is a set of 500 (100 for each DMA, also preserving the lag-0 cross-correlation between them) synthetic hourly demand pattern timeseries for C-Town, each having a duration of 2 weeks. Figure 2 illustrates the median and outer bands of the 100 synthetic hourly demand patterns generated for DMA1. This stochastically generated ensemble is then introduced to the WDN model of C-Town, to derive a spectrum of stochastic, yet realistic system states, any of which can exist when an attack occurs.

2.3. Threat Scenario and Risk Analysis

In a scenario-based risk assessment, the scenario is typically composed of a basic model of the system under common hydraulic conditions and a set of threats against assets of the water system. As a guiding tool to explore and identify potential cyber-physical threats against their systems, water utilities can utilize potential hazard databases either corporate, embedded in risk assessment toolkits, or found online.

In this study, we formulate an attack scenario against the monitoring and control system of C-Town, by targeting a tank’s water level sensor. The attacker hijacks the connection between the T1 sensor and the PLC, overseen by the SCADA, and inserts bogus information. The false signal leads the system to believe that T1 is at high level, and the subsequent action is to turn off the pumping station at the reservoir R1. This shut down may lead to (some or even all) tanks in the system to empty, resulting in water supply deficiencies in the DMAs. The attack starts at 00:00 of the 8th day in the simulation and lasts for 24 h.

The described threat is transcribed in an EPANET-based threat scenario utilizing the capabilities of RISKNOUGHT [27,28]. It is a stress-testing platform, capable of simulating complex cyber-physical water systems with an emphasis on the resilience assessment in terms of both hydraulic and water quality dimensions. More specifically, RISKNOUGHT is used to formulate and run (a) the deterministic attack scenario using the default C-Town patterns and hydraulic states and (b) the ensemble of 100 attack scenarios (i.e., in a Monte Carlo fashion) using the stochastically generated patterns per DMA, which also affect the hydraulic state prior to the attack. The modelling is supported by the implementation of Pressure Driven Analysis (PDA) to realistically simulate hydraulic failure conditions and more specifically, under the Wagner approach [29].

3. Probabilistic Assessment of the Threat Scenario

The deterministic assessment of the above-described cyber-physical attack scenario, results in a total of 10,295 m³ for the unmet demand metric (UD). Following the proposed stochastic risk assessment, the risk assessor produces an ensemble of 100 different realizations and hence, 100 different evaluations of the cyber-physical attack scenario. This allows the uncertainty-aware inference of the potential consequences, expressed probabilistically. The stochastic assessment of the potential consequences gives a median estimate of 10,805 m³ of potential unmet demand. The related statistical properties are summarized in

Table 1. Statistical characteristics of the unmet demand metric for the ensemble of 100 stochastically driven scenarios against C-Town.

	Median	Mean	Max	Min	Range	St. dev.	95th Percentile	5th Percentile
Unmet Demand (m3)	10,805.33	10,999.58	13,617.59	8495.15	5122.43	962.85	12,620.23	9542.48

. Comparing the median value to that of the deterministic quantification, the values exhibit a difference of ~5%. However, the potential unmet demand can highly vary from these values. Exploring the empirical distribution of the resulting metrics, the upper level, estimated using the 95th percentile, is 12,620 m³ and approximately 22.58% higher than the deterministic estimation. Moreover, the lower level, estimated for the 5th percentile, is 9542 m³ and is approximately 7.88% lower than the deterministic value.

There is significant fluctuation in the UD metric, which is a consequence of the hydraulic variability of the WDN at the time of attack. The development of 1-week (i.e., prior to the attack) stochastic demand patterns yields a range of potential system states, i.e., tank levels, valve and pump statuses, nodal pressures, etc. As presented in Figure 3, there is strong negative correlation between the T1 tank water level and the total unmet demand for the 1-week period after the attack. This is expected, as the T1 influences the most important controls of the system related to the reservoir outflow, and in addition it is the targeted infrastructure in the scenarios.

4. Conclusions

The deterministic assessment of threat scenarios can provide a quick estimation for the outcome of an event and its order of magnitude, assuming a typical state of the WDN. Yet, it is argued that deterministic assessments of risks under “average conditions” misinterpret or even ignore key drivers that affect the extent of an outcome, such as the demand variability. To account for such inherent uncertainties, this work proposes risk assessors to incorporate stochastically generated demands in the scenario-based risk assessment scheme. To showcase the stochastic risk assessment approach, a single threat scenario was simulated under a spectrum of synthetic, yet realistic, system states, driven by the ensemble of stochastically generated nodal demands. This Monte Carlo-type experiment was used to probabilistically assess the WDN model outputs, and hence derived a probabilistic estimate over the severity of the threat scenario. As indicated by the results, the deterministic risk assessment approach underestimated the potential severity of a threat. This can greatly affect their prioritization against other, less severe events, leading overall to sub-optimal resilience and security strategies for a water system.