{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T07:59:57Z","timestamp":1790150397659,"version":"4.0.1"},"reference-count":47,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,9,19]],"date-time":"2026-09-19T00:00:00Z","timestamp":1789776000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Water Research"],"published-print":{"date-parts":[[2027,1]]},"DOI":"10.1016\/j.watres.2026.126960","type":"journal-article","created":{"date-parts":[[2026,9,19]],"date-time":"2026-09-19T06:39:48Z","timestamp":1789799988000},"page":"126960","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"PC","title":["A closed-loop digital twin for cyber\u2013physical attack analysis and anomaly detection in water distribution networks"],"prefix":"10.1016","volume":"308","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7684-2755","authenticated-orcid":false,"given":"Valentine","family":"Machaka","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9958-9799","authenticated-orcid":false,"given":"Saioa","family":"Arrizabalaga","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5492-862X","authenticated-orcid":false,"given":"Be\u00f1at","family":"Elduayen-Echave","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-9185-7215","authenticated-orcid":false,"given":"Aitor Domec","family":"Paz","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9307-9787","authenticated-orcid":false,"given":"Josune","family":"Hernantes","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.watres.2026.126960_b1","first-page":"274","article-title":"Investigation of cyber attacks on a water distribution system","volume":"vol. 12418 LNCS","author":"Adepu","year":"2020"},{"issue":"2","key":"10.1016\/j.watres.2026.126960_b2","doi-asserted-by":"crossref","first-page":"356","DOI":"10.3390\/s26020356","article-title":"From edge transformer to iot decisions: Offloaded embeddings for lightweight intrusion detection","volume":"26","author":"Adjewa","year":"2026","journal-title":"Sensors"},{"key":"10.1016\/j.watres.2026.126960_b3","series-title":"Database Theory \u2014 ICDT 2001","first-page":"420","article-title":"On the surprising behavior of distance metrics in high dimensional space","author":"Aggarwal","year":"2001"},{"key":"10.1016\/j.watres.2026.126960_b4","series-title":"Revisiting anomaly detection in ICS: Aimed at segregation of attacks and faults","author":"Ahmed","year":"2020"},{"key":"10.1016\/j.watres.2026.126960_b5","doi-asserted-by":"crossref","DOI":"10.1016\/j.watres.2025.123719","article-title":"Breaking the flow and the bank: Stealthy cyberattacks on water network hydraulics","volume":"283","author":"Albustami","year":"2025","journal-title":"Water Res."},{"key":"10.1016\/j.watres.2026.126960_b6","series-title":"GLOBECOM 2025\u20132025 IEEE Global Communications Conference","first-page":"7","article-title":"A two-stage llm-enhanced ddos detection framework for next-generation iot and edge networks","author":"Alfatemi","year":"2025"},{"key":"10.1016\/j.watres.2026.126960_b7","series-title":"Proceedings of the 13th International Conference on Availability, Reliability and Security","first-page":"1","article-title":"Evaluation of machine learning-based anomaly detection algorithms on an industrial modbus\/TCP data set","author":"Anton","year":"2018"},{"issue":"103","key":"10.1016\/j.watres.2026.126960_b8","doi-asserted-by":"crossref","first-page":"7104","DOI":"10.21105\/joss.07104","article-title":"Epyt-flow: A toolkit for generating water distribution network data","volume":"9","author":"Artelt","year":"2024","journal-title":"J. Open Source Softw."},{"key":"10.1016\/j.watres.2026.126960_b9","series-title":"FDI attack detection exploiting statistical and temporal features of process sensors in ICS","author":"Bao","year":"2022"},{"key":"10.1016\/j.watres.2026.126960_b10","first-page":"217","article-title":"When is nearest neighbor meaningful","author":"Beyer","year":"1999"},{"key":"10.1016\/j.watres.2026.126960_b11","doi-asserted-by":"crossref","DOI":"10.1016\/j.oceaneng.2024.118390","article-title":"Multidimensional hybrid software-in-the-loop modeling approach for experimental analysis of a floating offshore wind turbine in wave tank experiments","volume":"309","author":"Bonnefoy","year":"2024","journal-title":"Ocean Eng."},{"issue":"2","key":"10.1016\/j.watres.2026.126960_b12","doi-asserted-by":"crossref","DOI":"10.14207\/ejsd.2017.v6n2p217","article-title":"Assessment of pump\u2019s performance in water supply systems \u2013 data collected from multiple case studies","volume":"6","author":"Cardoso","year":"2017","journal-title":"Eur. J. Sustain. Dev."},{"issue":"3","key":"10.1016\/j.watres.2026.126960_b13","doi-asserted-by":"crossref","DOI":"10.1016\/j.kjs.2025.100425","article-title":"Intelligent chlorination in water distribution networks: Integrating genetic algorithm and epanet fusion","volume":"52","author":"Chahkandi","year":"2025","journal-title":"Kuwait J. Sci."},{"key":"10.1016\/j.watres.2026.126960_b14","series-title":"Networking and security in industrial automation environments design guide","author":"CISCO","year":"2020"},{"issue":"1","key":"10.1016\/j.watres.2026.126960_b15","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1186\/s42162-024-00312-8","article-title":"A scoping review of in-the-loop paradigms in the energy sector focusing on software-in-the-loop","volume":"7","author":"Clausen","year":"2024","journal-title":"Energy Inform."},{"key":"10.1016\/j.watres.2026.126960_b16","series-title":"2024 35th Irish Signals and Systems Conference","first-page":"1","article-title":"Leveraging the mitre att & ck framework for threat identification and evaluation in industrial control system simulations","author":"Ekisa","year":"2024"},{"key":"10.1016\/j.watres.2026.126960_b17","first-page":"1","article-title":"Directive (eu) 2020\/2184 of the european parliament and of the council of 16 december 2020 on the quality of water intended for human consumption (recast)","volume":"L 435","author":"European Parliament and Council of the European Union","year":"2020","journal-title":"Off. J. Eur. Union"},{"key":"10.1016\/j.watres.2026.126960_b18","doi-asserted-by":"crossref","first-page":"122385","DOI":"10.1109\/ACCESS.2021.3109465","article-title":"A hardware-in-the-loop water distribution testbed dataset for cyber\u2013physical security testing","volume":"9","author":"Faramondi","year":"2021","journal-title":"IEEE Access"},{"issue":"2","key":"10.1016\/j.watres.2026.126960_b19","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3381038","article-title":"A survey of IIoT protocols: A measure of vulnerability risk analysis based on CVSS","volume":"53","author":"Figueroa-Lorenzo","year":"2020","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.watres.2026.126960_b20","series-title":"INES 2025-29th IEEE International Conference on Intelligent Engineering Systems 2025, Proceedings","first-page":"39","article-title":"Supervisor water level control for the tanks in a modular water distribution network testbed","author":"Fragkoulis","year":"2025"},{"key":"10.1016\/j.watres.2026.126960_b21","series-title":"A Virtual Cybersecurity Department for Securing Digital Twins in Water Distribution Systems","author":"Homaei","year":"2025"},{"key":"10.1016\/j.watres.2026.126960_b22","series-title":"Anomaly detection for industrial control systems using sequence-to-sequence neural networks","author":"Inoue","year":"2019"},{"key":"10.1016\/j.watres.2026.126960_b23","series-title":"Proceedings of the Thirty-Sixth AAAI Conference on Artificial Intelligence","first-page":"7173","article-title":"Towards a rigorous evaluation of time-series anomaly detection","author":"Kim","year":"2022"},{"issue":"92","key":"10.1016\/j.watres.2026.126960_b24","doi-asserted-by":"crossref","first-page":"5947","DOI":"10.21105\/joss.05947","article-title":"Epyt: An epanet-python toolkit for smart water network simulations","volume":"8","author":"Kyriakou","year":"2023","journal-title":"J. Open Source Softw."},{"issue":"22","key":"10.1016\/j.watres.2026.126960_b25","doi-asserted-by":"crossref","first-page":"7074","DOI":"10.3390\/s25227074","article-title":"Enhancing intrusion detection for iot and sensor networks through semantic analysis and self-supervised embeddings","volume":"25","author":"Liu","year":"2025","journal-title":"Sensors"},{"key":"10.1016\/j.watres.2026.126960_b26","first-page":"170","article-title":"Cyberattack kill chain analysis on hydraulic infrastructure","volume":"11","author":"Liu","year":"2025","journal-title":"J. Robot. Netw. Artif. Life"},{"key":"10.1016\/j.watres.2026.126960_b27","series-title":"2008 Eighth IEEE International Conference on Data Mining","first-page":"413","article-title":"Isolation forest","author":"Liu","year":"2008"},{"key":"10.1016\/j.watres.2026.126960_b28","doi-asserted-by":"crossref","DOI":"10.1155\/2023\/5486566","article-title":"Design and implementation of a lightweight security-enhanced scheme for Modbus TCP protocol","volume":"2023","author":"Liu","year":"2023","journal-title":"Secur. Commun. Netw."},{"key":"10.1016\/j.watres.2026.126960_b29","doi-asserted-by":"crossref","DOI":"10.1016\/j.compeleceng.2025.110485","article-title":"Assessing the impact of modbus\/tcp protocol attacks on critical infrastructure: Wwtp case study","volume":"126","author":"Machaka","year":"2025","journal-title":"Comput. Electr. Eng."},{"key":"10.1016\/j.watres.2026.126960_b30","series-title":"2016 International Workshop on Cyber\u2013Physical Systems for Smart Water Networks","first-page":"31","article-title":"Swat: A water treatment testbed for research and training on ics security","author":"Mathur","year":"2016"},{"key":"10.1016\/j.watres.2026.126960_b31","series-title":"Real Decreto 3\/2023, de 10 de Enero, por El Que Se Establecen Los Criterios T\u00e9cnico-Sanitarios de la Calidad del Agua de Consumo, su Control y Suministro","author":"Ministerio de Sanidad, Gobierno de Espa\u00f1a","year":"2023"},{"key":"10.1016\/j.watres.2026.126960_b32","series-title":"ACM International Conference Proceeding Series PartF168343","first-page":"13","article-title":"Co-simulating physical processes and network data for high-fidelity cyber-security experiments","author":"Murillo","year":"2020"},{"key":"10.1016\/j.watres.2026.126960_b33","series-title":"2024 5th International Conference on Innovative Trends in Information Technology","first-page":"1","article-title":"A study on air-gap networks","author":"Na","year":"2024"},{"key":"10.1016\/j.watres.2026.126960_b34","doi-asserted-by":"crossref","first-page":"256","DOI":"10.1080\/1573062X.2021.1995446","article-title":"Stress-testing water distribution networks for cyber\u2013physical attacks on water quality","volume":"19","author":"Nikolopoulos","year":"2022","journal-title":"Urban Water J."},{"key":"10.1016\/j.watres.2026.126960_b35","series-title":"Proceedings - 45th IEEE Symposium on Security and Privacy Workshops","first-page":"246","article-title":"Towards cyber\u2013physical representation and cyber-resilience against attack and failure within a hydraulic network simulation toolkit","author":"O\u2019Toole","year":"2024"},{"key":"10.1016\/j.watres.2026.126960_b36","doi-asserted-by":"crossref","first-page":"5154","DOI":"10.1109\/ACCESS.2024.3525008","article-title":"Explainability of network intrusion detection using transformers: A packet-level approach","volume":"13","author":"Rajkumardheivanayahi","year":"2025","journal-title":"IEEE Access"},{"key":"10.1016\/j.watres.2026.126960_b37","doi-asserted-by":"crossref","DOI":"10.1016\/j.watres.2025.123517","article-title":"Optimal cybersecurity framework for smart water system: Detection, localization and severity assessment","volume":"281","author":"Raza","year":"2025","journal-title":"Water Res."},{"key":"10.1016\/j.watres.2026.126960_b38","series-title":"EMNLP-IJCNLP 2019\u20132019 Conference on Empirical Methods in Natural Language Processing and 9th International Joint Conference on Natural Language Processing, Proceedings of the Conference","first-page":"3982","article-title":"Sentence-bert: Sentence embeddings using siamese bert-networks","author":"Reimers","year":"2019"},{"issue":"7","key":"10.1016\/j.watres.2026.126960_b39","doi-asserted-by":"crossref","first-page":"1443","DOI":"10.1162\/089976601750264965","article-title":"Estimating the support of a high-dimensional distribution","volume":"13","author":"Sch\u00f6lkopf","year":"2001","journal-title":"Neural Comput."},{"key":"10.1016\/j.watres.2026.126960_b40","doi-asserted-by":"crossref","DOI":"10.1061\/(ASCE)EE.1943-7870.0001665","article-title":"Evaluating resilience of water distribution networks to operational failures from cyber\u2013physical attacks","volume":"146","author":"Shin","year":"2020","journal-title":"J. Environ. Eng."},{"key":"10.1016\/j.watres.2026.126960_b41","doi-asserted-by":"crossref","first-page":"46","DOI":"10.1016\/j.envsoft.2018.11.008","article-title":"A toolbox for assessing the impacts of cyber\u2013physical attacks on water distribution systems","volume":"112","author":"Taormina","year":"2019","journal-title":"Environ. Model. Softw."},{"issue":"8","key":"10.1016\/j.watres.2026.126960_b42","doi-asserted-by":"crossref","DOI":"10.1061\/(ASCE)WR.1943-5452.0000969","article-title":"Battle of the attack detection algorithms: Disclosing cyber attacks on water distribution networks","volume":"144","author":"Taormina","year":"2018","journal-title":"J. Water Resour. Plan. Manag."},{"issue":"4","key":"10.1016\/j.watres.2026.126960_b43","first-page":"1","article-title":"Introduction to the modbus protocol","volume":"9","author":"Thomas","year":"2008","journal-title":"Ext."},{"key":"10.1016\/j.watres.2026.126960_b44","article-title":"Cybersecurity in the eu: How the nis2-directive stacks up against its predecessor","volume":"52","author":"Vandezande","year":"2024","journal-title":"Comput. Law Secur. Rev."},{"key":"10.1016\/j.watres.2026.126960_b45","doi-asserted-by":"crossref","first-page":"2146","DOI":"10.1109\/TASLP.2020.3008390","article-title":"Sbert-wk: A sentence embedding method by dissecting bert-based word models","volume":"28","author":"Wang","year":"2020","journal-title":"IEEE\/ACM Trans. Audio Speech Lang. Process."},{"key":"10.1016\/j.watres.2026.126960_b46","series-title":"Guidelines for Drinking-Water Quality: Fourth Edition Incorporating the First Addendum","author":"World Health Organization","year":"2017"},{"issue":"1","key":"10.1016\/j.watres.2026.126960_b47","doi-asserted-by":"crossref","first-page":"11","DOI":"10.1186\/s13635-025-00191-w","article-title":"Bert-based network for intrusion detection system","volume":"2025","author":"Yang","year":"2025","journal-title":"EURASIP J. Inf. Secur."}],"container-title":["Water Research"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0043135426016313?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0043135426016313?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T07:02:27Z","timestamp":1790146947000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0043135426016313"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2027,1]]},"references-count":47,"alternative-id":["S0043135426016313"],"URL":"https:\/\/doi.org\/10.1016\/j.watres.2026.126960","relation":{},"ISSN":["0043-1354"],"issn-type":[{"value":"0043-1354","type":"print"}],"subject":[],"published":{"date-parts":[[2027,1]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A closed-loop digital twin for cyber\u2013physical attack analysis and anomaly detection in water distribution networks","name":"articletitle","label":"Article Title"},{"value":"Water Research","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.watres.2026.126960","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"126960"}}