###### Abstract  
Anomaly detection involves identifying data that deviates from normal patterns. Two primary strategies are used: one-class classification and binary classification. In Industrial Control Systems (ICS), where anomalies can cause significant damage, timely and accurate detection is essential, often requiring analysis of time-series data. One-class classification is commonly used but tends to have a high false alarm rate. To address this, binary classification is explored, which can better differentiate between normal and anomalous data, though it struggles with class imbalance in ICS datasets. This paper proposes a mutation-based technique for generating ICS time-series anomalies. The method maps ICS time-series data into a latent space using a variational recurrent autoencoder, applies mutation operations, and reconstructs the time-series, introducing plausible anomalies that reflect multivariate correlations. Evaluations of ICS datasets show that these synthetic anomalies are visually and statistically credible. Training a binary classifier on data augmented with these anomalies effectively mitigates the class imbalance problem. anomaly generation; variational Bayes; attention mechanism; recurrent neural network; industrial control system +
Footnote †: journal:  
The lack of research on time-series anomaly generation exacerbates the issue of building robust anomaly detection models in ICS environments. ICS is core to various domains like the manufacturing industry, electrical grids, and transportation systems. These systems share a closed nature, which makes data collection challenging. Moreover, the data inherently have time-series characteristics. As a result, this leads to data imbalance, making it difficult to train robust anomaly detection models and consequently reducing the reliability of performance evaluation. Therefore, in this paper, we focus on generating pseudo-time-series anomalies in the ICS environment. Based on our observation, there are three major challenges in generating time-series anomalies. (1) Unlike i.i.d data, time-series data exhibit dependencies between data samples over time. In other words, when generating anomalies for time-series data, it is crucial to reflect this temporal dependency; (2) In the case of multivariate data, an anomaly in one feature can affect other features due to the correlations between them. However, systematically calculating these correlations and assigning values manually is not scalable [9]; (3) Anomalous data are inherently rare compared to normal data, making it difficult to determine an accurate probability distribution for these data. This scarcity complicates the process of generating data through sampling from a probability distribution. To overcome the identified challenges, our insights are as follows. (1) By using variational inference, we map normal data into a latent space that follows a well-known probability distribution [10]. Variational inference is a method for training generative models, where the model maximizes the evidence lower bound (ELBO); (2) By ensuring that the latent space follows a well-known probability distribution, we can easily sample latent vectors and generate new data from them. Additionally, since we already know the statistical properties of the probability distribution, we can appropriately tamper with the latent vectors to generate anomalous data; (3) Inspired by dynamic software testing methods such as fuzzing, we adopt mutation to modify latent vectors [11; 12]. These insights guide our approach to effectively generate time-series anomalies while addressing the challenges of temporal dependency, multivariate correlation, and data scarcity. In this paper, we propose a method for generating pseudo anomalous data for industrial process data by synthesizing the aforementioned insights. The proposed method consists of two main parts. First, we map industrial time-series data to latent variables using a neural network.