# Dual Auto-Encoder GAN-Based Anomaly Detection for Industrial Control System
## 4 Dual Auto-Encoder GAN-Based Anomaly Detection for Industrial Control System (DAGAN)
### DAGAN Model
#### 4.1.2 Model Pipeline  
The pipeline of our DAGAN model is shown in Figure 2. The DAGAN model tries to use only normal samples to learn an efficient neural network that can achieve accurate anomaly detection in the feature space, thereby reducing the false positive rate. Our DAGAN consists of three important components: the first GAN, the second GAN, and the feature extractor.  
(1) The first GAN is an important component, which is responsible for helping the generator \(G_{1}\) to learn the normal distribution of the training samples through adversarial training between the generator \(G_{1}\) and the discriminator \(D_{1}\). The generator \(G_{1}\) consists of an encoder \(G_{En}\) and a decoder \(G_{Dn1}\), both of which are multilayer perceptron networks. The encoder \(G_{En}\) is responsible for converting the normal data \(x\) into a low-dimensional vector \(z\), and the decoder \(G_{Dn1}\) is responsible for reconstructing the data \(x_{1}^{\prime}\) according to \(z\), and ensuring that the generated data \(x_{1}^{\prime}\) are similar to the original data \(x\). The discriminator \(D_{1}\) is also a multi-layer perceptron, responsible for a binary classification of the original data \(x\) and the generated data \(x_{1}^{\prime}\). Because a large number of samples in the training dataset are concentrated in the non-tail region, the latent distribution that can be learned by this GAN cannot cover the marginal distribution well, which will inevitably lead to poor discrimination scores for marginal samples.  
(2) The second GAN is another important component that is responsible for learning the marginal distribution of the training samples to make up for the shortcomings of the first GAN. The generator \(G_{2}\) is also an auto-encoder architecture, consisting of an encoder \(G_{En}\) and decoder \(G_{Dn1}\). The purpose of \(G_{1}\) and \(G_{2}\) sharing the encoder \(G_{En}\) is to ensure that  
Figure 2: The pipeline of DAGAN model.  
the generated data come from the same low-dimensional latent feature \(z\). \(G_{Dn2}\) has the same multilayer perceptron structure as \(G_{Dn1}\), but each learns different parameters. The goal of \(G_{Dn2}\) is to generate a marginal sample \(x^{\prime}_{2}\) based on \(z\). Likewise, the discriminators \(D_{2}\) and \(D_{1}\) have the same neural network structure but different parameters.  
(3) The feature extractor is the third component, which is responsible for converting the data generated by the two GANs into low-dimensional features again, and then performing more accurate anomaly detection from the low-dimensional feature space, so as to avoid the influence of noise in the high-dimensional data space and improve the stability of the model. The feature extractor consists of encoder \(En_{1}\) and encoder \(En_{2}\). The \(En_{1}\) is responsible for encoding \(x^{\prime}_{1}\), and ensuring that the resulting low-dimensional feature \(z^{\prime}_{1}\) is the same as the low-dimensional feature \(z\) of the original data \(x\). Likewise, \(En_{2}\) is responsible for encoding \(x^{\prime}_{2}\) and ensuring that the \(z^{\prime}_{1}\) is the same as the \(z\). Finally, the low-dimensional vectors \(z^{\prime}_{1}\) and \(z^{\prime}_{2}\) are combined to achieve more accurate anomaly detection.