## 1 Introduction  
In recent years, security incidents occur frequently in industrial control systems. The traditional security research is mainly based on a firewall and trap system in the industrial control system. Once the defense system is broken, the intruder directly enters the business layer to tamper with business data, which will cause huge losses [1]. No matter how the attack is carried out, it will eventually lead to abnormal operation data at the bottom of the industrial control system and cause safety accidents. Anomaly detection of industrial underlying operating data is mainly used to identify runtime data anomalies, which is the last line of defense for security [2]. At present, a large amount of operation data has been accumulated in the industrial control system. However, most of these data are samples under normal conditions, with few abnormal samples, and none of them is the sample of the system being attacked. In order to study the underlying business data of industrial control system for anomaly detection, the research group collected 30 public industrial control datasets, and found that only two of them included the underlying data attack samples. They are the natural gas pipeline dataset [3] of the SCADA Laboratory of Mississippi State University (the gas dataset) and the Singapore dataset [4; 5; 6]. Due to the lack of attack samples, it is difficult to build more industrial control security datasets. Although some attack samples can be obtained from simulated attacks, they are not enough to support deep learning model training. It is an urgent problem to design an efficient data enhancement method for the characteristics of underlying business data. At present, artificial intelligence deep learning algorithms are widely used in various fields. For example, convolutional neural networks are commonly used in target trackingand target detection [7; 8]. In the field of data expansion, the most efficient and common way is GAN (Generative Adversarial Network) [9], but most GAN derivative networks do not apply to industrial control underlying business data attack samples. In 2019, [PERSON] et al. [10] and others proposed the time series data generation model of Bilstm-CNN GAN and published papers on nature. This method is mainly aimed at the time series data generation of ECG samples. ECG data have the characteristics of time sequence, periodicity and low data dimension. However, the step-type and pulse-type data in the underlying business data of industrial control are non-periodic, and the data dimension of the entire dataset is high, and there are many types of data changes. If BiLSTM-CNN GAN or other GANs for temporal data generation are used, step-type and pulse-type data will be treated as noise, and it is difficult to learn attack characteristics. In order to solve the problems of the variety and non-periodicity of the attack sample characteristics of the industrial control system, this paper adopts different methods for different types of data. For oscillation type data, momentum is selected as the optimizer of its discriminator, and GAN is used to generate data directly. For Step type data, an improved Adam optimizer based on GAN is used. When the discriminator encounters step jump, the Adam optimizer decouples instantaneously to prevent step jump from being ignored as noise. For the pulse data, GAN is used to generate data for its positive samples. Then, the pulse signal is generated and inserted into the generated positive example sample. Finally, attack samples are formed.