HydroVigil

Inspiration

Water pipelines are critical infrastructure, ensuring continuous supply to essential services. Disruptions directly impact public health and economic stability. IoT and SCADA systems improve monitoring but expand the attack surface. Increased connectivity introduces vulnerabilities in sensors and networks. Cyber-attacks often remain undetected, mimicking normal fluctuations. Manual monitoring cannot scale with real-time system data.

What it does

HydroVigil focuses on detecting cyber-attacks in time-series sensor data within water pipelines. It identifies abnormal behavior caused by malicious manipulation but does not automatically take corrective actions. Detection and alerting is the critical first step in securing infrastructure.

How we built it

Architecture DATA INPUT ├── Real-Time Sensor Streams └── Historical Pipeline Data │ ▼ DATA ACQUISITION LAYER │ ▼ PREPROCESSING & FEATURE ENGINEERING ├── Missing Value Handling ├── Normalization ├── Time-Series Feature Extraction │ ├── Temporal Patterns │ └── Trend & Seasonality │ ▼ MODELING & DETECTION └── Baseline Behavior Modeling │ ▼ SECURITY ANALYSIS & RESPONSE ├── Cyber-Attack Classification Layer ├── Identify Attack-Like Behavior ├── Alert & Visualization Layer ├── Dashboard Display └── Human Analyst / Operator │ ▼ (Analyst Feedback Loop) ML Model Details HydroVigil uses a confidence-based dual-model architecture:

Primary Model — Transformer -> Captures long-range temporal dependencies in sensor data -> Dominant decision-maker in the pipeline -> Outputs a confidence score per window
Fallback Model — LSTM -> Fault-tolerant fallback activated only when Transformer confidence is low (~3% of scenarios) -> Ensures continuous detection even during model uncertainty
Decision Logic if transformer_confidence >= threshold: use transformer_prediction else: use lstm_prediction # fallback activated
Window-Based Processing -> Instead of processing every single data point, the system uses sliding windows: Window size: 100 seconds Stride: 10 Drastically reduces computational load while maintaining detection accuracy 'window_size = 100 stride = 10 X_train_windows = create_windows(X_train_std, window_size, stride) # Train windows shape: (138700, 100, 44)'

Accomplishments that we're proud of

-> An AI-powered industrial control dashboard that monitors water system sensor data in real time, detects cyber-physical anomalies, and simulates coordinated attacks for system resilience testing. It integrates sensor health metrics, anomaly confidence scoring, incident logs, and network topology visualization to enable rapid threat identification and response. -> Our dashboard contains System Status – Indicates if a cyber attack is active. Network & Sensors – Shows total nodes and active sensors. Threat Score – Overall cyber risk level (0–100). Anomaly Count – Number of abnormal events detected. Live Monitoring Graph – Real-time sensor behavior trends. AI Threat Briefing – Attack summary with recommended actions. Incident Log – Time-stamped list of detected security Sensor ID & Event Type – Identifies which sensor and what abnormal activity occurred Event Status – Shows whether the issue is under monitoring or investigation Simulation Control – Indicates an attack simulation in progress and system reset option -> Fault tolerance - • Real-time monitoring of system health and attack status • Adaptive recovery mechanisms activated during failures • Continuous learning to reduce false alarms and improve resilience

What's next for HydroVigil

Deployment (planned): Docker, Kubernetes, Apache Kafka, Apache Flink, Redis

HydroVigil is designed for real-world deployment across three tiers:

Small Utilities (Panchayats, small towns) — SaaS subscription at ₹5,000–₹15,000/month
Industrial Plants (Food, pharma, manufacturing) — On-premise license at ₹2L–₹10L one-time
Government / Municipal (Water boards, smart cities) — Enterprise contract + maintenance at ₹25L–₹1Cr/year