{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,8]],"date-time":"2026-06-08T16:58:06Z","timestamp":1780937886918,"version":"3.54.1"},"reference-count":57,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2027,4,21]],"date-time":"2027-04-21T00:00:00Z","timestamp":1808265600000},"content-version":"am","delay-in-days":171,"URL":"http:\/\/www.elsevier.com\/open-access\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CMMI-2316653"],"award-info":[{"award-number":["CMMI-2316653"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Reliability Engineering & System Safety"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.ress.2026.112770","type":"journal-article","created":{"date-parts":[[2026,4,18]],"date-time":"2026-04-18T14:52:57Z","timestamp":1776523977000},"page":"112770","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"P1","title":["Unsupervised cyber-physical intrusion detection and localization in water distribution systems via multivariate fusion of process, supervisory, and communication data"],"prefix":"10.1016","volume":"275","author":[{"given":"Hojat","family":"Behrooz","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6576-3808","authenticated-orcid":false,"given":"Mohammad","family":"Ilbeigi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.ress.2026.112770_bib0001","series-title":"Guidelines for drinking-water quality","year":"2017"},{"key":"10.1016\/j.ress.2026.112770_bib0002","series-title":"Water supply and distribution systems","year":"2024"},{"key":"10.1016\/j.ress.2026.112770_bib0003","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2023.109910","article-title":"Looking beyond individual failures: a system-wide assessment of water infrastructure resilience to extreme events","volume":"244","author":"Tiedmann","year":"2024","journal-title":"Reliab Eng Syst Saf"},{"key":"10.1016\/j.ress.2026.112770_bib0004","series-title":"Proceedings of the 6th ACM symposium on information, computer and communications security","first-page":"355","article-title":"Attacks against process control systems: risk assessment, detection, and response","author":"Cardenas","year":"2008"},{"issue":"12","key":"10.1016\/j.ress.2026.112770_bib0005","doi-asserted-by":"crossref","DOI":"10.1061\/(ASCE)WR.1943-5452.0000703","article-title":"Effectiveness of smart meter-based consumption feedback in curbing household water use: knowns and unknowns","volume":"142","author":"S\u00f8nderlund","year":"2016","journal-title":"J Water Resour Plan Manag"},{"key":"10.1016\/j.ress.2026.112770_bib0006","series-title":"Enforcement alert: drinking water systems to address cybersecurity vulnerabilities","year":"2024"},{"key":"10.1016\/j.ress.2026.112770_bib0007","series-title":"Critical infrastructure protection: epa urgently needs a strategy to address cybersecurity risks to water and wastewater systems","year":"2024"},{"key":"10.1016\/j.ress.2026.112770_bib0008","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2025.111417","article-title":"Robustness analysis of CPPS against malware attacks under malware incubation and attack-defense confrontation","author":"Zhang","year":"2025","journal-title":"Reliab Eng Syst Saf"},{"key":"10.1016\/j.ress.2026.112770_bib0009","series-title":"Compromise of U.S. water treatment facility","first-page":"AA21","year":"2021"},{"key":"10.1016\/j.ress.2026.112770_bib0010","article-title":"Rural Texas towns report cyberattacks that caused one water system to overflow | AP News","author":"Miller","year":"2024","journal-title":"AP News"},{"key":"10.1016\/j.ress.2026.112770_bib0011","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2026.112189","article-title":"A tri-level cybersecurity risk assessment model of cyber-physical power systems under uncertain coordinated attacks","author":"Kong","year":"2026","journal-title":"Reliab Eng Syst Saf"},{"issue":"2\u20133","key":"10.1016\/j.ress.2026.112770_bib0012","doi-asserted-by":"crossref","first-page":"141","DOI":"10.1016\/0166-3615(94)90017-5","article-title":"The Purdue enterprise reference architecture","volume":"24","author":"Williams","year":"1994","journal-title":"Comput Ind"},{"key":"10.1016\/j.ress.2026.112770_bib0013","series-title":"Guide to industrial control systems (ICS) security (NIST sp 800-82 rev. 2)","author":"Stouffer","year":"2015"},{"key":"10.1016\/j.ress.2026.112770_bib0014","series-title":"ISA\/IEC 62443-1-1 series of standards on industrial automation and control systems security","year":"2018"},{"key":"10.1016\/j.ress.2026.112770_bib0015","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2025.111027","article-title":"Dynamic cross-layer security risk assessment and mitigation for cyber-physical power systems","volume":"261","author":"Yao","year":"2025","journal-title":"Reliab Eng Syst Saf"},{"key":"10.1016\/j.ress.2026.112770_bib0016","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2025.111483","article-title":"A decentralized defense model for covert zero-dynamic attacks in industrial control systems","author":"Peng","year":"2026","journal-title":"Reliab Eng Syst Saf"},{"key":"10.1016\/j.ress.2026.112770_bib0017","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2023.109299","article-title":"Transfer adversarial attacks across industrial intelligent systems","volume":"237","author":"Yin","year":"2023","journal-title":"Reliab Eng Syst Saf"},{"issue":"1","key":"10.1016\/j.ress.2026.112770_bib0018","doi-asserted-by":"crossref","DOI":"10.1061\/(ASCE)WR.1943-5452.0001023","article-title":"Real-time identification of cyber-physical attacks on water distribution systems via Machine Learning\u2013Based anomaly detection techniques","volume":"145","author":"Abokifa","year":"2018","journal-title":"J Water Resour Plan Manag"},{"key":"10.1016\/j.ress.2026.112770_bib0019","first-page":"351","article-title":"Supervised learning methods for cyber-physical security in water distribution systems","volume":"111","author":"Taormina","year":"2017","journal-title":"Water Res"},{"key":"10.1016\/j.ress.2026.112770_bib0020","article-title":"Detection framework for bidirectional false data injection attacks to enhance reliability in cyber-physical power systems","author":"Zhang","year":"2026","journal-title":"Reliab Eng Syst Saf"},{"key":"10.1016\/j.ress.2026.112770_bib0021","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2025.111741","article-title":"Unveiling explosive vulnerability of networks through edge collective behavior","author":"Peng","year":"2026","journal-title":"Reliab Eng Syst Saf"},{"issue":"1","key":"10.1016\/j.ress.2026.112770_bib0022","doi-asserted-by":"crossref","first-page":"86","DOI":"10.1109\/TDSC.2018.2875008","article-title":"Distributed attack detection in a water treatment plant: method and case study","volume":"18","author":"Adepu","year":"2018","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"10.1016\/j.ress.2026.112770_bib0023","series-title":"Proceedings of the 2024 workshop on re-design industrial control systems with security","first-page":"9","article-title":"On practical realization of evasion attacks for industrial control systems","author":"Erba","year":"2024"},{"issue":"5","key":"10.1016\/j.ress.2026.112770_bib0024","doi-asserted-by":"crossref","first-page":"1963","DOI":"10.1109\/TCST.2012.2211873","article-title":"Cyber security of water SCADA systems\u2014part I: analysis and experimentation of stealthy deception attacks","volume":"21","author":"Amin","year":"2013","journal-title":"IEEE Trans Control Syst Technol"},{"key":"10.1016\/j.ress.2026.112770_bib0025","series-title":"Proceeding, water research","first-page":"132","article-title":"Model based approach for cyber-physical attacks detection in water distribution systems","author":"Housh","year":"2018"},{"key":"10.1016\/j.ress.2026.112770_bib0026","doi-asserted-by":"crossref","unstructured":"Rossman, L.A. (2011). An overview of EPANET version 3.0. 12th Annual Conference on Water Distribution Systems Analysis (WDSA), https:\/\/doi.org\/10.1061\/41203(425)3.","DOI":"10.1061\/41203(425)3"},{"key":"10.1016\/j.ress.2026.112770_bib0027","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2022.108653","article-title":"Modelling cyber resilience in a water treatment and distribution system","volume":"226","author":"Patriarca","year":"2022","journal-title":"Reliab Eng Syst Saf"},{"key":"10.1016\/j.ress.2026.112770_bib0028","series-title":"Proceedings of the 2017 ACM on Asia conference on computer and communications security","first-page":"101","article-title":"Model-based attack detection scheme for smart water distribution networks","author":"Ahmed","year":"2017"},{"issue":"21","key":"10.1016\/j.ress.2026.112770_bib0029","first-page":"746","article-title":"Sequential monitoring of SCADA systems against cyber\/physical attacks","volume":"48","author":"Do","year":"2015","journal-title":"IFAC-Pap"},{"key":"10.1016\/j.ress.2026.112770_bib0030","series-title":"World environmental and water resources congress 2017","first-page":"660","article-title":"Identification of cyber attacks on water distribution systems by unveiling low-dimensionality in the sensory data","author":"Giacomoni","year":"2017"},{"issue":"6","key":"10.1016\/j.ress.2026.112770_bib0031","doi-asserted-by":"crossref","first-page":"795","DOI":"10.3390\/w13060795","article-title":"Cyber-attack detection in water distribution systems based on blind sources separation technique","volume":"13","author":"Brentan","year":"2021","journal-title":"Water"},{"key":"10.1016\/j.ress.2026.112770_bib0032","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s40537-025-01342-z","article-title":"An adversarial variational graph autoencoder with contrastive learning for robust anomaly detection in large scale attributed networks","volume":"13","author":"Khan","year":"2026","journal-title":"J Big Data"},{"key":"10.1016\/j.ress.2026.112770_bib0033","article-title":"Unified representation and scoring framework for anomaly detection in attributed networks with emphasis on structural consistency and attribute integrity","volume":"15","author":"Khan","year":"2025","journal-title":"Sci Rep"},{"key":"10.1016\/j.ress.2026.112770_bib0034","doi-asserted-by":"crossref","first-page":"1203","DOI":"10.1007\/s42452-025-07801-9","article-title":"A multi-stage hybrid framework for anomaly detection in attributed graphs using attention-driven representation and community-aware scoring","volume":"7","author":"Khan","year":"2025","journal-title":"Discov Appl Sci"},{"key":"10.1016\/j.ress.2026.112770_bib0035","doi-asserted-by":"crossref","DOI":"10.1007\/s41060-025-00848-2","article-title":"A robust framework for topology-based anomaly detection in attributed networks using graph attention networks, substructure analysis, and data augmentation","author":"Khan","year":"2025","journal-title":"Int J Data Sci Anal"},{"key":"10.1016\/j.ress.2026.112770_bib0036","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.113144","article-title":"ANOGAT-Sparse-TL: a hybrid framework combining sparsification and graph attention for anomaly detection in attributed networks using the optimized loss function incorporating the Twersky loss for improved robustness","volume":"311","author":"Khan","year":"2025","journal-title":"Knowl Based Syst"},{"key":"10.1016\/j.ress.2026.112770_bib0037","doi-asserted-by":"crossref","first-page":"42777","DOI":"10.1109\/ACCESS.2025.3544260","article-title":"Enhancing anomaly detection in attributed networks using proximity preservation and advanced embedding techniques","volume":"13","author":"Khan","year":"2025","journal-title":"IEEE Access"},{"key":"10.1016\/j.ress.2026.112770_bib0038","doi-asserted-by":"crossref","first-page":"65555","DOI":"10.1109\/ACCESS.2024.3398555","article-title":"Detecting anomalies in attributed networks through sparse canonical correlation analysis combined with random masking and padding","volume":"12","author":"Khan","year":"2024","journal-title":"IEEE Access"},{"issue":"2","key":"10.1016\/j.ress.2026.112770_bib0039","doi-asserted-by":"crossref","first-page":"137","DOI":"10.1016\/j.dsm.2024.09.002","article-title":"Residual-enhanced graph convolutional networks with hypersphere mapping for anomaly detection in attributed networks","volume":"8","author":"Khan","year":"2025","journal-title":"Data Sci Manag"},{"issue":"2","key":"10.1016\/j.ress.2026.112770_bib0040","doi-asserted-by":"crossref","first-page":"89","DOI":"10.1016\/j.dsm.2023.10.005","article-title":"Anomalous node detection in attributed social networks using dual variational autoencoder with generative adversarial networks","volume":"7","author":"Khan","year":"2024","journal-title":"Data Sci Manag"},{"key":"10.1016\/j.ress.2026.112770_bib0041","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2026.112417","article-title":"Conformal machine learning for reliable anomaly detection in industrial cyber-physical systems","volume":"274","author":"Yuan","year":"2026","journal-title":"Reliab Eng Syst Saf"},{"issue":"Part B","key":"10.1016\/j.ress.2026.112770_bib0042","article-title":"Unsupervised cyberattack detection in smart grids: a novel approach integrating horizontal federated learning for the control center and substations","volume":"264","author":"Zheng","year":"2025","journal-title":"Reliab Eng Syst Saf"},{"key":"10.1016\/j.ress.2026.112770_bib0043","doi-asserted-by":"crossref","DOI":"10.1016\/j.ress.2023.109410","article-title":"Deep probabilistic graphical modeling for robust multivariate time series anomaly detection with missing data","volume":"238","author":"Yang","year":"2023","journal-title":"Reliab Eng Syst Saf"},{"key":"10.1016\/j.ress.2026.112770_bib0044","series-title":"World environmental and water resources congress 2017","first-page":"101","article-title":"Water distribution systems analysis symposium\u2013battle of the attack detection algorithms (batadal)","author":"Aghashahi","year":"2017"},{"issue":"10","key":"10.1016\/j.ress.2026.112770_bib0045","doi-asserted-by":"crossref","DOI":"10.1061\/(ASCE)WR.1943-5452.0000983","article-title":"Deep-learning approach to the detection and localization of cyber-physical attacks on water distribution systems","volume":"144","author":"Taormina","year":"2018","journal-title":"J Water Resour Plan Manag"},{"issue":"2","key":"10.1016\/j.ress.2026.112770_bib0046","doi-asserted-by":"crossref","DOI":"10.1061\/(ASCE)WR.1943-5452.0001007","article-title":"Cyberattack detection using deep generative models with variational inference","volume":"145","author":"Chandy","year":"2019","journal-title":"J Water Resour Plan Manag"},{"issue":"9","key":"10.1016\/j.ress.2026.112770_bib0047","doi-asserted-by":"crossref","first-page":"1247","DOI":"10.3390\/w13091247","article-title":"Cyber\u2014Physical attack detection in water distribution systems with temporal graph convolutional neural networks","volume":"13","author":"Tsiami","year":"2021","journal-title":"Water"},{"issue":"16","key":"10.1016\/j.ress.2026.112770_bib0048","doi-asserted-by":"crossref","first-page":"6035","DOI":"10.3390\/s22166035","article-title":"Detecting and localizing cyber-physical attacks in water distribution systems without records of labeled attacks","volume":"22","author":"Housh","year":"2022","journal-title":"Sensors"},{"issue":"1","key":"10.1016\/j.ress.2026.112770_bib0049","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/S0169-7439(99)00047-7","article-title":"The Mahalanobis distance","volume":"50","author":"De Maesschalck","year":"2000","journal-title":"Chemom Intell Lab Syst"},{"issue":"1","key":"10.1016\/j.ress.2026.112770_bib0050","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1111\/anzs.12144","article-title":"Evaluating the contributions of individual variables to a quadratic form","volume":"58","author":"Garthwaite","year":"2016","journal-title":"Aust N Z J Stat"},{"key":"10.1016\/j.ress.2026.112770_bib0051","series-title":"Introduction to statistical quality control","author":"Montgomery","year":"2020"},{"issue":"7","key":"10.1016\/j.ress.2026.112770_bib0052","article-title":"Multilevel Monitoring System for Road Networks: anomaly detection at the network and road-segment levels","volume":"150","author":"Behrooz","year":"2024","journal-title":"J Transp Eng A: Syst"},{"key":"10.1016\/j.ress.2026.112770_bib0053","unstructured":"Bai, S., Kolter, J.Z., & Koltun, V. (2018). An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. https:\/\/doi.org\/10.48550\/arXiv.1803.01271."},{"key":"10.1016\/j.ress.2026.112770_bib0054","unstructured":"Erba, A., Murillo, A.F., Taormina, R., Galelli, S., & Tippenhauer, N.O. (2024). Evasion attacks and concealment in water-distribution ICS with DHALSIM (BATADAL v2.0)."},{"key":"10.1016\/j.ress.2026.112770_bib0055","first-page":"1","article-title":"Unsupervised machine anomaly detection using autoencoder and temporal convolutional network","volume":"71","author":"Li","year":"2022","journal-title":"IEEE Trans Instrum Meas"},{"issue":"6","key":"10.1016\/j.ress.2026.112770_bib0056","doi-asserted-by":"crossref","first-page":"515","DOI":"10.1080\/07408170008963928","article-title":"A general approach to modeling CUSUM charts for a proportion","volume":"32","author":"Reynolds","year":"2000","journal-title":"IIE Trans"},{"key":"10.1016\/j.ress.2026.112770_bib0057","series-title":"Introduction to information retrieval","author":"Manning","year":"2008"}],"container-title":["Reliability Engineering & System Safety"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0951832026005818?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0951832026005818?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,6,8]],"date-time":"2026-06-08T16:00:36Z","timestamp":1780934436000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0951832026005818"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":57,"alternative-id":["S0951832026005818"],"URL":"https:\/\/doi.org\/10.1016\/j.ress.2026.112770","relation":{},"ISSN":["0951-8320"],"issn-type":[{"value":"0951-8320","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Unsupervised cyber-physical intrusion detection and localization in water distribution systems via multivariate fusion of process, supervisory, and communication data","name":"articletitle","label":"Article Title"},{"value":"Reliability Engineering & System Safety","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.ress.2026.112770","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"112770"}}