## 2 Background  
The research object of anomaly detection technology for underlying business data in an industrial control system is the attacked business data. If there is no sufficient attack sample, all the deep learning anomaly detection algorithms for the underlying business data of industrial control will not be able to train. Three datasets are currently collected that contain samples of underlying business data attacks: the natural gas pipeline dataset of SCADA laboratory of Mississippi State University (the gas dataset), the Singapore dataset, and the real underlying business dataset of an oil depot (the oil dataset).  
Take the oil dataset as an example. The attack sample dataset of an oil depot has certain temporal characteristics, so it is necessary to pay attention to the temporal relationship of newly generated samples in data generation. At the same time, the dataset includes the flow, pressure and other characteristics of each oil tank. The characteristics of industrial control attack samples will produce step jumps or oscillation fluctuations according to different types of attacks in different periods. Figure 1a is a feature of oscillation type change. The data fluctuates violently when attacked, which is a common fluctuation in industrial control attack sample data. Figure 1b is a feature of step type change. The data generate a huge step jump at the moment of attack. The data range changes significantly and remains unchanged within the duration of attack. Until the end of the attack, the data range returns to the normal range. The change trend of data before and after jump is similar. The specific trend is shown in the following formula:  
The time sequence range of step type data are \(t_{0}\sim t_{n-1}t_{n}t_{n+1}\sim t_{m}\), where \(t_{n}\) is the time when the step jump occurs, \(n+1<m\) and \(m-(n+1)=(n-1)-0\):\[S(y)=S(\frac{1}{n}\sqrt{\sum_{i=0}^{n-1}(y_{t_{i}}-y_{t_{n+i+1}})}) \tag{1}\]  
Data curve \(Q\) is bounded by \(t_{n}\), and the changes of the two curves are similar. When \(Q<S\) and \(|\tilde{y}_{t_{0}\sim t_{n-1}}-\tilde{y}_{t_{n+1}\sim t_{n}}|>\varepsilon\), the curve is said to have a step, where \(\varepsilon\gg\tilde{y}_{t_{0}\sim t_{n-1}}\) or \(\varepsilon\gg\tilde{y}_{t_{n+1}\sim t_{n}}\).  
This classification of the underlying business data of industrial control is also applicable to the Singapore dataset. It comes from a real-life medium-sized water supply network, C-Town water system, established by iTrust, Network Security Research Center of Singapore University of Science and Technology. The system includes 1 independent reservoir, 5 valves, 5 pumping stations, 11 pumps, 7 storage tanks, 388 interfaces and 423 pipelines. The dataset has 130 feature dimensions, which can be divided into oscillation types and step type according to the fluctuation of time series data of each feature and whether there is step jump.  
However, only the two classification methods for data expansion above are not applicable to the gas dataset. The Mississippipi dataset comes from a set of SCADA systems based on all physical objects researched by Mississippi State University, in which the natural gas tank dataset is the underlying business dataset containing the attack. The natural gas data set has 26 dimensions, in which multiple feature data are in the form of pulses. Figure 1c shows the pulse type change feature, which is different from the step type change data value range. This feature constantly tampers with the data when being attacked, and the binary value jumps repeatedly to form the pulse change.  
According to the characteristics of three kinds of industrial control underlying data, this paper studies the adaptive industrial control attack sample expansion algorithm based on GAN, to solve the sample generation problem of step type, oscillation type, and pulse type data.