arXiv: Tool Demo: Topology analysis with GPML for detection of cyberattacks in Water Distribution Networks

A new academic paper, published on arXiv, introduces a tool that applies topological data analysis, combined with Gaussian Process Maximum Likelihood, to detect cyberattacks on water distribution networks. This is a research publication, not a new regulation or binding legal standard. However, it signals a growing technical capability to identify anomalies in critical infrastructure operations, which is directly relevant to the EU's evolving AI Safety framework and the proposed Cyber Resilience Act.

The primary audience is operators of critical infrastructure, specifically water utilities and municipal authorities managing distribution systems, as well as industrial control system vendors. These organizations face increasing scrutiny under the NIS2 Directive and sector-specific rules that require robust threat detection and incident reporting. The paper demonstrates a method that could become a reference for best practice in monitoring, potentially influencing future technical standards or audit expectations for resilience.

Compliance teams should monitor this development as an indicator of emerging technical controls. They should assess whether their current intrusion detection systems for operational technology can incorporate similar analytical methods, and begin a gap analysis against this advanced capability. While no immediate action is required, it is prudent to document awareness of this research in your risk assessment files and engage with technical teams to evaluate its feasibility for your specific network architecture. This positions your organization ahead of potential future regulatory expectations.