## 3 Datasets for the Attack and Anomaly Detection
### HAI Dataset Analysis  
The dataset describes the parameters of an industrial control system testbed with an embedded simulator. The testbed comprises four elements: a boiler, turbine, water-treatment component, and a hardware-in-the-loop (HIL) simulator. The HIL simulation \begin{table}
\begin{tabular}{l c c c c c} \hline \hline  & \multicolumn{5}{c}{**Validation Data**} \\ \hline  & **ACC** & **P** & **R** & **FPR** & **F1** \\ \hline  & \multicolumn{5}{c}{**Sklearn**} \\ \hline ocSVM & 0.942 & 0.000 & 0.000 & 1.000 & 0.000 \\ isoF & 0.935 & 0.022 & 0.003 & 0.997 & 0.005 \\ \hline  & \multicolumn{5}{c}{**PYOD**} \\ \hline ECOD & 0.942 & 0.466 & 0.011 & 0.989 & 0.021 \\ COPOD & 0.942 & 0.000 & 0.000 & 1.000 & 0.000 \\ kNN & 0.058 & 0.058 & 1.000 & 0.000 & 0.110 \\ DeepSVDD & 0.601 & 0.045 & 0.293 & 0.707 & 0.079 \\ VAE & 0.933 & 0.000 & 0.000 & 1.000 & 0.000 \\ AutoEncoder & 0.933 & 0.000 & 0.000 & 1.000 & 0.000 \\ AnoGan & 0.943 & 0.672 & 0.043 & 0.957 & 0.081 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The results of Experiment 2 for the SWaT dataset (for validation data). \begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline \multirow{2}{*}{**Optimal Threshold**} & \multicolumn{5}{c}{**Train Data**} & \multicolumn{5}{c}{**Test Data**} \\ \cline{2-10}  & **ACC** & **ACC** & **P** & **R** & **FPR** & **F1** & **AUC-ROC** & **AUC-ROC** \\ \hline  & \multicolumn{5}{c}{**Sklearn**} \\ \hline ocSVM & 0.990 & 0.936 & 0.998 & 0.585 & 0.415 & 0.738 & 0.808 & 0.082 \\ isoF & 0.960 & 0.777 & 0.124 & 0.932 & 0.068 & 0.219 & 0.833 & 0.072 \\ \hline  & \multicolumn{5}{c}{**PYOD**} \\ \hline ECOD & 0.900 & 0.833 & 0.981 & 0.598 & 0.402 & 0.743 & 0.858 & 0.758 \\ COPOD & 0.960 & 0.919 & 0.948 & 0.619 & 0.381 & 0.749 & 0.855 & 0.756 \\ KNN & 0.960 & 0.127 & 0.987 & 0.636 & 0.364 & 0.774 & 0.816 & 0.727 \\ DeepSVDD & 0.960 & 0.766 & 0.991 & 0.646 & 0.354 & 0.783 & 0.838 & 0.732 \\ VAE & 0.960 & 0.410 & 0.991 & 0.633 & 0.368 & 0.772 & 0.820 & 0.732 \\ AutoEnc & 0.960 & 0.410 & 0.991 & 0.633 & 0.368 & 0.772 & 0.820 & 0.732 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: The results of Experiment 3 for the SWaT dataset. implements a simulation of the thermal power and pumped-storage hydropower generation. When forming the dataset, several different attack scenarios were used, aimed at three types of devices: the Emerson Ovation, GE Mark-VIe, and Siemens S7-1500. During the attack, the attacker operates with four types of variables: set points, process variables, control variables, and control parameters. The set of certain values of these variables in a given period of time determines one of two behaviours of the system: anomalous or normal. When the system is operating normally, the values of the process variables change within a predefined range. To this end, the operator adjusts the set point values, which allows for achieving stable and predictable results in the behaviour of the sensors, and the entire system as a whole. This dataset has three versions: HAI 20.07, HAI 21.03, and HAI 22.04. Statistical information about each of them is given in Table 9.  
Figure 3 shows 10 features which keep the highest correlation value with the class label for files test1.csv within HAI 20.07, HAI 21.03, and HAI 22.04. Table 10 contains the values of F-measure (\(F1\)) and accuracy (ACC) in percentages for 5 classifiers: decision tree (DT), KNN, random forest, logistic regression, and neural network (NN). _Conclusions._ We analyzed the obtained results considering the set requirements. The requirements R1, R2, R3, and R4 are satisfied. The requirement R5 is also satisfied; however, considering the existence of the simulated part of the test bed, the quality of the dataset depends on the quality of the simulated part of the test bed. The preliminary experimental results are in line with the results obtained in other research papers. Thus, this dataset is consistent and suitable for the intrusion detection task.