Author ORCID Identifier:
Date of Graduation
5-2026
Document Type
Thesis
Degree Name
Master of Science in Computer Science (MS)
Degree Level
Graduate
Department
Electrical Engineering and Computer Science
Advisor/Mentor
Li, Qinghua
Committee Member
Zhang, Lu
Second Committee Member
Sikder, Nazmul K.
Third Committee Member
Pan, Yanjun
Keywords
Smart Water Systems; Anomaly Detection; Graph Deviation Network (GDN)
Abstract
Anomaly detection in water treatment systems is essential for ensuring the safety and reliability of cyber-physical infrastructure. Graph-based models such as the Graph Deviation Network (GDN) capture inter-sensor dependencies effectively; however, they suffer from three practical limitations: unstable training behavior, incomplete detection coverage under prediction-only signals, and difficulty translating anomaly scores into reliable operational decisions. To address these limitations, this thesis proposes a structured extension of GDN and evaluates it on three water-domain datasets: SWaT, WADI, and ACWA. First, we improve training reliability by introducing orthogonal embedding initialization, gradient clipping, and learning-rate warmup, reducing seed-dependent failures and improving cross-run consistency. Second, we extend the detection mechanism through a dual-signal framework (GDN-RD), where a lightweight frozen reconstruction decoder complements prediction error. This increases attack segment detection on SWaT from 12 to 18 out of 35 (a 50% improvement). Third, we further leverage ensemble diversity across multiple GDN variants, achieving Oracle F1 of 0.835 for GDN-RD and 0.854 for the Top-5 ensemble, improving robustness without increasing architectural complexity. Beyond detection, we address deployment challenges by introducing a Learnable Decision Head (LDH) that replaces static thresholding with a learned decision boundary, achieving LDH F1 = 0.920 under a calibrated semi-supervised setting exceeding the oracle-threshold upper bound on all three datasets. Finally, the system integrates graph-based root cause localization with large language model (LLM) generated alerts, transforming anomaly scores into actionable insights for operators. Overall, the results demonstrate that improving stability, incorporating complementary detection signals, and learning decision boundaries are more impactful than increasing model complexity, providing a robust and practical framework for anomaly detection in cyber-physical water systems.
Citation
Tyagi, A. (2026). Graph-Based and Ensemble Anomaly Detection for Smart Water Treatment Systems. Graduate Theses and Dissertations Retrieved from https://scholarworks.uark.edu/etd/6250
