HydroJEV: A one-second, training-free screen for cyber-attack and fault attribution in water distribution networks· 水网警报快速诊断模型
When a SCADA alarm is raised in a water distribution network, operators must decide quickly whether it reflects a cyberattack, a physical fault, a normal transient or a faulty sensor. Supervised classifiers need labelled incidents that utilities rarely have, and frontier large language models (LLMs) take tens of seconds per decision. We tested whether Jev, a training-free model that returns class probabilities in about one second, can serve as the first tier of this triage. On a four-class cause-attribution benchmark built on the C-Town network in EPANET, Jev was compared with a hand-written rule tree, a supervised classifier and seven cloud LLMs on identical evidence in four sealed, pre-registered rounds. With only a label-free prior correction, Jev matched the rule tree (macro-F1 0.62-0.
模型快速诊断水网报警，区分网络攻击与故障。
- 核心方法
- 提出了一种无需训练的模型Jev，能够在大约一秒钟内返回类概率，用于快速诊断。
- 适合谁读
- 研究者、工程师
- 要解决的问题
- 在水分配网络中，如何快速准确地区分SCADA警报是网络攻击、物理故障、正常瞬变还是传感器故障。
- 关键实验
- 在基于EPANET的C-Town网络四类原因归属基准上，通过四轮密封、预先注册的实验，比较了Jev模型与手写规则树、监督分类器及七种云LLM的性能。
- 主要贡献
- Jev模型在无需训练的情况下，达到了与手写规则树相当的诊断准确率，显著提高了诊断速度。
- 意义与局限
- 该研究为水分配网络的安全与维护提供了快速有效的解决方案，但模型的适用性可能受限于特定网络结构。