# Dual Auto-Encoder GAN-Based Anomaly Detection for Industrial Control System
## 5 Experimental Evaluation  
### Experimental Dataset  
In this paper, two publicly available industrial control system datasets are selected to train and verify our DAGAN model. The detailed descriptions of the two datasets are as follows:  
**(1) DS2 OS dataset**: This dataset is an open source and publicly accessible dataset, which was collected from Kaggle ([[https://www.kaggle.com/francoisxa/ds2](https://www.kaggle.com/francoisxa/ds2) ostraffictraces]([https://www.kaggle.com/francoisxa/ds2](https://www.kaggle.com/francoisxa/ds2) ostraffictraces) or [[https://github.com/fkie-cad/ipal_datasets](https://github.com/fkie-cad/ipal_datasets)]([https://github.com/fkie-cad/ipal_datasets](https://github.com/fkie-cad/ipal_datasets)), accessed on 13 December 2021) provided by Pahl. This dataset is an IoT testbed dataset generated by Distributed Smart Space Orchestration System (DS2 OS). This dataset contains 357,952 samples, of which the number of normal samples is 347,935, and the number of abnormal samples is 10017. For each sample, there are 13 features. All abnormal samples can be classified into the following 7 types of attacks: Denial of Service (DoS), Data Type Probing (DP), Malicious Control (MC), Malicious Operation (MO), Scan (SC), Spying (SP), and Wrong Setup (WS). More specifically, 5780 samples belong to the DoS attack, 342 samples belong to the DP attack, 889 samples belong to the MC attack, 805 samples belong to the MO attack, 1547 samples belong to the SCAN attack, 532 samples belong to the SP attack, and 122 samples belong to the WS attack.  
**(2) SWaT dataset**: This dataset is an open source and publicly accessible dataset ([[https://itrust.suttd.edu.sg/itrust-labs-home/itrust-labs_swat/](https://itrust.suttd.edu.sg/itrust-labs-home/itrust-labs_swat/)]([https://itrust.suttd.edu.sg/itrust-labs-home/itrust-labs_swat/](https://itrust.suttd.edu.sg/itrust-labs-home/itrust-labs_swat/)) or [[https://github.com/fkie-cad/ipal_datasets](https://github.com/fkie-cad/ipal_datasets)]([https://github.com/fkie-cad/ipal_datasets](https://github.com/fkie-cad/ipal_datasets)), accessed on 17 December 2021). This dataset was generated by a water treatment testbed. This dataset is collected from 51 sensors and executor within 11 days. In the 11 days, the testbed was running normally in the first 7 days, and various attacks were randomly injected into the testbed in the last 4 days. This dataset contains 946,722 samples, each with 103 features. This dataset contains 4 types of attacks: Single-Stage Single-Point (SSSP), Single-Stage Multi-Point (SSMP), Multi-Stage Single-Point (MSSP), and Multi-Stage Multi-Point (MSMP) attacks. More specifically, the number of all attacks is 36, of which the number of SSSP attacks is 23, the number of SSMP attacks is 6, the number of MSSP attacks is 4, and the number of MSMP attacks is 3. The duration of each attack is between 1 and 60 min.  
For simplicity, 20,000 normal samples in DS2 OS dataset are used as the training set in this paper, 1500 normal samples and 350 abnormal samples are used as the test set (50 samples for each attack). For the SWaT dataset, 15,000 normal samples are used as the training set in this paper, 700 normal samples and 160 abnormal samples are used as the test set (40 samples for each attack).