## 3 Datasets for the Attack and Anomaly Detection
### SWaT Dataset Analysis
\begin{table}
\begin{tabular}{l c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Optimal**} & \multicolumn{5}{c}{**Train Data**} & \multicolumn{5}{c}{**Test Data**} \\ \cline{2-13}  & **P** & **R** & **FPR** & **F1** & \begin{tabular}{c} **AUC-** \\ **ROC** \\ \end{tabular} & **P** & **R** & **FPR** & **F1** & \
\begin{tabular}{c} **AUC-** \\ **ROC** \\ \end{tabular} & **P** & **R** & **FPR** & **F1** &
\begin{tabular}{c} **AUC-** \\ **ROC** \\ \end{tabular} & **P** \\ \hline \multicolumn{13}{c}{**Sklearn**} \\ \hline ocSVM & 0.300 & 0.795 & 0.205 & 0.436 & 0.723 & 0.087 & 0.355 & 0.193 & 0.807 & 0.250 & 0.654 & 0.051 \\ isoF & 0.045 & 0.240 & 0.760 & 0.076 & 0.868 & 0.072 & 0.065 & 0.839 & 0.161 & 0.120 & 0.567 & 0.051 \\ \hline \multicolumn{13}{c}{**PVOD**} \\ \hline ECOD & 0.806 & 0.668 & 0.331 & 0.731 & 0.879 & 0.772 & 0.310 & 0.270 & 0.730 & 0.289 & 0.791 & 0.240 \\ COPOD & 0.879 & 0.662 & 0.338 & 0.755 & 0.878 & 0.791 & 0.497 & 0.268 & 0.732 & 0.348 & 0.796 & 0.236 \\ KNN & 0.252 & 0.008 & 0.993 & 0.015 & 0.204 & 0.087 & 0.819 & 0.752 & 0.248 & 0.784 & 0.935 & 0.739 \\ Deep-SVDD & 0.803 & 0.011 & 0.989 & 0.022 & 0.633 & 0.187 & 0.965 & 0.079 & 0.921 & 0.147 & 0.566 & 0.143 \\ VAE & 0.729 & 0.745 & 0.255 & 0.737 & 0.892 & 0.666 & 0.364 & 0.493 & 0.507 & 0.419 & 0.785 & 0.201 \\ AutoEnc & 0.721 & 0.753 & 0.247 & 0.737 & 0.894 & 0.672 & 0.305 & 0.460 & 0.540 & 0.367 & 0.793 & 0.205 \\ AnoGAN & 0.896 & 0.653 & 0.347 & 0.756 & 0.875 & 0.777 & 0.422 & 0.212 & 0.788 & 0.282 & 0.695 & 0.182 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The results of Experiment 1 for the time split mode for the SWaT dataset. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Record Type** & **Number of Impacted Processes** & **Impacted Processes** & **Number of Samples** \\ \hline Normal & 0 & 0 & 399,157 \\ \hline  & 1 & P1 & 4053 \\  & 1 & P2 & 1809 \\  & 1 & P3 & 37,860 \\  & 1 & P4 & 1700 \\ Attack & 1 & P5 & 1044 \\  & 2 & P3, P4 & 1691 \\  & 2 & P1, P3 & 1445 \\  & 2 & P3, P6 & 697 \\  & 2 & P4, P5 & 463 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Distribution of the attacks per processes in SWaT datasetExperiment 2.For this experiment series, we used the data from \"Attack_v0.csv\" and \"Normal_v0.csv\" files to form train, test, and validation subsamples. The train and test subsamples incorporated all instances before 2 January 2016, with 672,989 normal instances and 41,186 attack instances for train and 168,247 normal instances and 10,297 attack instances for test (contamination is equal to 0.061 for both) after 80% to 20% stratified train test split. Meanwhile, the validation sample consisted of all instances after 2 January 2016 (inclusively), with 50,862 normal instances and 3138 attack instances and contamination of 0.062. The results of experiment 2 for different anomaly detection machine learning models are provided in Tables 6 and 7. It can be seen that rather close results are obtained for the ECOD (F1-measure 0.718, AUC-ROC 0.864, and AUC-PRC 0.530 on the testing sample), COPOD (F1-measure 0.729, AUC-ROC 0.867, and AUC-PRC 0.563 on the testing sample), VAE (F1-measure 0.732, AUC-ROC 0.896, and AUC-PRC 0.505 on the testing sample), AutoEnc (F1-measure 0.732, AUC-ROC 0.896, and AUC-PRC 0.505 on the testing sample), and AnoGAN (F1-measure 0.746, AUC-ROC 0.851, and AUC-PRC 0.555 on the testing sample). Experiment 3.The data from \"Attack_v0.csv\", \"Normal_v0.csv\", and \"Normal_v1.csv\" files together were used to train algorithms in novelty detection or unsupervised mode in this experiment series. The data contain 1,441,719 instances in total, including 1,387,098 normal instances and 54,621 attack instances with contamination of 0.039. To train algorithms, all instances from \"Normal_v0.csv\" and \"Normal_v1.csv\" files (except stabilization period of 3 hours) were used, while all instances from \"Attack_v0.csv\" file were used for testing. The train sample included 972,000 normal instances and no attack instances.