## 3 Patterns of Time-Series Anomaly  
Understanding the characteristics and patterns of anomalous data is as crucial as the techniques for generating time-series or anomalies. Several studies have explored the patterns of time-series anomalies [38; 39; 40; 41]. We synthesize the findings of these studies to comprehensively analyze anomaly patterns. Based on this analysis, we design mutation operations in Section 4 to reproduce these patterns. Specifically, we focus on continuous data collected from industrial processes [42; 43], rather than discrete data such as log data.  
[PERSON] et al. [41] analyzed various publicly available time-series datasets and categorized the anomalous data within these datasets into several patterns. Broadly, this study distinguishes between anomaly patterns occurring at single data points and interval anomaly patterns (collective anomalies) that span multiple data points.  
Anomaly patterns for single data points are further divided into point anomalies, which exceed expected value ranges, and contextual anomalies, which do not. Additionally, the concept of multiple anomalies, where several anomalous data points are present, is mentioned. [PERSON] et al. [40] and [PERSON] et al. [39] proposed anomaly detection models for health monitoring data and, as part of their research, analyzed the anomaly patterns within the data. These studies fundamentally consider data that deviate statistically from the norm as anomalies.  
In addition to conducting a literature review, we analyzed well-known ICS datasets to examine the anomaly patterns contained within these datasets. Specifically, we analyzed the SWaT [42] and the HIL-based augmented ICS security dataset (HAI) [43]. The secure water treatment (SWaT) [42] dataset is derived from a water treatment testbed designed for ICS and security research. This testbed consists of six processes: raw water intake, chemical dosing, ultrafiltration (UF), reverse osmosis (RO), RO filtration, and UF backwash. In this study, three types of attackers were modeled, performing various attacks such as network packet sniffing and physical access.  
The HAI [43] dataset also originates from a testbed primarily for water treatment, consisting of four major processes: the boiler process, turbine process, water treatment process, and hardware-in-the-loop simulator. The dataset was collected over more than ten days, capturing three types of attacks: process variable response prevention, setpoint attack, and control output attack.  
Figure 1 illustrates the anomaly patterns found in the HAI and SWaT datasets. The blue and red lines represent normal data and anomalies, respectively. As seen in the figure, the anomaly patterns in both ICS datasets mostly correspond to point anomalies or contextual anomalies as defined by [PERSON] et al. [41]. The SWaT dataset includes some collective anomalies.  
Furthermore, according to Figure 1, the collective anomalies in the SWaT dataset can be categorized as minor types, as described by [PERSON] et al. [40] and [PERSON] et al. [39]. Based on our literature review and analysis of the anomaly patterns in ICS datasets, we focus on generating point anomalies, contextual anomalies, and collective anomalies from given normal ICS time-series data.