# Dual Auto-Encoder GAN-Based Anomaly Detection for Industrial Control System
## 6 Conclusions  
To find outliers more robustly and accurately in industrial control systems, this paper developed a dual auto-encoder GAN-based anomaly detection model called DAGAN. First, this model only uses normal samples to train an \"encoder-decoder-encoder\" architecture, which can achieve anomaly detection without any abnormal samples and enhances the applicability of the model. Second, a dynamic optimization strategy is designed to be incorporated into the DAGAN model to better learn the marginal distribution of training data and reduce the misjudgment of marginal samples. Third, considering both normal distribution and marginal distribution, an optimized anomaly score is defined to judge whether a sample is outlier, so as to improve the accuracy of anomaly detection. Extensive experimental results on DS2 OS and SWaT datasets demonstrate the effectiveness of our DAGAN model's optimization strategy for marginal distribution learning. The advantages of the DAGAN model are further demonstrated by comparative experiments with other state-of-the-art methods. In future work, the aim is to extend the method to the multi-class case to achieve multi-class anomaly detection. Since the anomaly category is difficult to obtain, the method proposed in this paper can be as a front-stage technique to extract sample features. Then, the model to be studied in the next step can achieve multi-classification anomaly detection from two aspects: (1) in the case of zero-shot, the category of attacks is detected by clustering methods [28, 29] according to the extracted features by the method in this paper; (2) in the case of few-shot, the GAN model proposed in this paper is used to supplement and balance the number of small samples in each category, so as to improve the accuracy of existing methods for multi-classification. Conceptualization, L.C., Y.L., X.D. and Z.L. ; methodology, M.L. and H.Z. ; validation, Y.L., X.D. and H.Z. ; formal analysis, L.C. ; investigation, Y.L. and X.D. ; resources, Z.L. ; data curation, M.L. ; writing--original draft preparation, L.C. ; writing--review and editing, Y.L. and M.L. ; visualization, X.D., Z.L. and H.Z. ; supervision, L.C. and Z.L. All authors have read and agreed to the published version of the manuscript. Figure 10: Anomaly detection performance analysis of multiple models on SWaT dataset. **Funding:** This work is supported by the National Key Research and Development Program (No. 2019 YFE0105300); the National Natural Science Foundation of China (No. 62103143); the Hunan Provincial Natural Science Foundation of China (Nos. 2020 JJ5199 and 2021 JJ30280); the National Defense Basic Research Program of China (JCKY2019403D006); the Hunan Province Key Research and Development Program (No. 2022 WK2006); the Outstanding Youth Project of Education Department of Hunan Province of China (No.19B200);and the Scientific Research Fund of Hunan Provincial Education Department (Nos. 20C0786, 21C0335 and 20C0781). **Institutional Review Board Statement:** Not applicable. **Informed Consent Statement:** Not applicable. **Data Availability Statement:** The DS2 OS dataset is a public dataset that can be attained at [[https://www.kaggle.com/francoisxa/ds2](https://www.kaggle.com/francoisxa/ds2) ostraffictraces]([https://www.kaggle.com/francoisxa/ds2](https://www.kaggle.com/francoisxa/ds2) ostraffictraces) or [[https://github.com/fkie-cad/ipal_datasets](https://github.com/fkie-cad/ipal_datasets)]([https://github.com/fkie-cad/ipal_datasets](https://github.com/fkie-cad/ipal_datasets)) (accessed on 13 December 2021).