Turn on the tap and water comes out.
It’s a system that we generally take for granted—but probably shouldn’t—in an increasingly hostile world where life-sustaining infrastructure has become a target for sophisticated hackers.
“Cyber attacks are happening here in the U.S. and all around the globe,” says Nazia Raza ’24G, a third-year Lehigh University PhD student who is advised by Farrah Moazeni, an assistant professor of civil and environmental engineering. “There’s an urgent need to develop techniques and solutions to identify and mitigate those threats to water distribution, energy, and other infrastructure systems.”
Raza recently published a paper in the journal Water Research, in which she outlines a novel holistic cybersecurity framework for smart water distribution systems. She describes it as a “comprehensive guide” for water authorities that will allow them to detect attacks, localize them, and assess their severity. Although other models have addressed detection or localization in isolation, such a three-part model is the first of its kind.
“The first step is to be able to detect an attack when it happens,” says Raza. “Then, you need to know where it’s being launched, because you might have thousands of pipes and valves within a system.”
For example, if the attack is located at pipe number 3000, she explains, the water authority’s decision-maker would need to prioritize the range and types of attacks to best allocate the resources needed to resolve them.
“For this, you need a severity assessment,” she says. “We’ve come up with a framework that solves each of these three problems and can be directly deployed to enhance the cybersecurity protection layers of our smart water distribution systems.”
The model builds on preliminary work in the detection of cyberattacks that Raza presented at the 2024 World Environmental and Water Resources Congress in Milwaukee. That paper, titled A Holistic Cybersecurity Framework against False Data Injection Attacks in Smart Water Distribution Systems Employing Auto-Encoders, took second place in the graduate paper competition.
“With false data injections, the attack is minimal yet detrimental to the network,” she says. For instance, if an attacker manipulates the system so that a pump set to operate at 90 percent capacity gradually drops down to 60 percent, everything else in the system follows the attack pattern. “We wanted to know if we could develop a machine learning model that could detect these false data injection attacks, and we came up with one that could identify them both quickly and accurately.”
The award represented a significant moment for Raza, who did her undergraduate work in her home country of Pakistan. It was not only the first such recognition she’d received for her research, but it was on a global stage with students from around the world competing for honors. She found it especially validating when the presenter commented on how much the paper had taught him about machine learning.
“While I know the research has the potential for impact,” she says, “it really only matters if people outside the field can understand it. That was a big win.”
Raza, whose interest in civil engineering traces back to a childhood fascination with skyscrapers and other huge buildings, will continue researching machine learning approaches in the face of uncertainties in both water and energy systems. It’s motivating work, she says, because without the safety, viability, and reliability of both, life as we know it would be unimaginable.
For millions of people, however, the unimaginable is their reality.
“In my country, there are people without sufficient access to water and electricity,” she says. “That’s why optimizing these systems is so important to me. We need to fix these systems so they work for everyone.”
