## 4 Mutation-Based Multivariate Time-Series Anomaly Generation in ICS
### Mutation operators  
We define three mutation operators to generate ICS time-series anomalies of the type analyzed in Section 3, utilizing the aforementioned characteristics. Algorithms 1-3 are the mutation operators for generating point anomalies, contextual anomalies, and collective anomalies, respectively. All three algorithms are applied to the hidden state sequence \(\mathbf{h}^{e}_{1:T}\) produced by the encoder of AVRAE and return the mutated sequence \(\mathbf{\hat{h}}^{e}_{1:T}\).  
```
input :the encoder's hidden state sequence \(\mathbf{h}^{e}_{1:T}\) output :the mutated hidden state sequence \(\mathbf{\hat{h}}^{e}_{1:T}\) \(t\leftarrow\mathcal{U}(1,T)\); \(\mathbf{v}\leftarrow\mathcal{N}(0,I)\); \(\mathbf{h}^{e}_{1:T}(t)\leftarrow\mathbf{v}_{r}\); \(\mathbf{\hat{h}}^{e}_{1:T}\leftarrow\mathbf{h}^{e}_{1:T}\);
```  
**Algorithm 1**Mutation operator \(\mathcal{M}_{p}\) for point anomaly generation.  
```
input :the encoder's hidden state sequence \(\mathbf{h}^{e}_{1:T}\) output :the mutated hidden state sequence \(\mathbf{\hat{h}}^{e}_{1:T}\) \(t_{s}\leftarrow\mathcal{U}(1,T)\); \(t_{d}\leftarrow\mathcal{U}(t_{s},T)\); \(\mathbf{v}\leftarrow\mathbf{h}^{e}_{1:T}(t_{s})\); \(\mathbf{h}^{e}_{1:T}(t_{d})\leftarrow\mathbf{v}_{r}\); \(\mathbf{\hat{h}}^{e}_{1:T}\leftarrow\mathbf{h}^{e}_{1:T}\);
```  
**Algorithm 2**Mutation operator \(\mathcal{M}_{ctx}\) for contextual anomaly generation.  
```
input :the encoder's hidden state sequence \(\mathbf{h}^{e}_{1:T}\) output :the mutated hidden state sequence \(\mathbf{\hat{h}}^{e}_{1:T}\) \(t_{s}\leftarrow\mathcal{U}(1,T)\); \(\mathbf{v}\leftarrow\mathbf{h}^{e}_{1:T}(t_{s})\); \(\mathbf{h}^{e}_{1:T}(t_{s})\leftarrow\mathbf{v}_{r}\); \(\mathbf{\hat{h}}^{e}_{1:T}\leftarrow\mathbf{h}^{e}_{1:T}\);
```  
**Algorithm 3**Mutation operator \(\mathcal{M}_{col}\) for collective anomaly generation.  
Algorithm 1 introduces a point anomaly into the given hidden state sequence. First, an index \(t\) is randomly selected to specify the element in the hidden state sequence to be altered. Then, a random value \(\mathbf{v}\) is sampled from the standard normal distribution to replace the \(t\)-th element of the hidden state sequence.  
Algorithm 2 is the mutation operator \(\mathcal{M}_{ctx}\) for generating contextual anomalies. This algorithm randomly selects two indices \(t_{s}\) and \(t_{d}\) that are smaller than the total length of the sequence \(T\). Then, it replaces the value at the \(t_{d}\)-th position in the hidden state sequence with the value \(\mathbf{v}\) from the \(t_{s}\)-th position. The rationale behind this design is that contextual anomalies inherently have values within the normal range but are considered abnormal within a given context. Therefore, Algorithm 2 generates anomalies by altering the context of normal values within the hidden state sequence.  
Lastly, Algorithm 3 is the mutation operator \(\mathcal{M}_{col}\) for generating collective anomalies. This algorithm first randomly selects two indices \(t_{s}\) and \(t_{d}\), both less than the total length of the sequence \(T\), to specify the segment to mutate. Then, it replaces the values in this segment of the hidden state sequence with a sequence \(\mathbf{v}_{t_{s}:t_{d}}\) composed of arbitrary values, generating the mutated sequence \(\hat{\mathbf{R}}^{\epsilon}_{1:T}\).  
Depending on the method used to generate \(\mathbf{v}_{t_{s}:t_{d}}\), various types of collective anomalies can be produced. While there are multiple approaches, this study recommends replacing with a sequence of constant vectors, a sequence of random vectors, or a sequence from another segment. The first two methods are the simplest ways to create \(\mathbf{v}_{t_{s}:t_{d}}\), while the latter extends contextual anomalies into collective anomalies. It is noteworthy that the three algorithms presented so far only mutate the hidden state sequence and do not directly generate actual time-series anomalies.