# A Framework for Synthetic Agetech Attack Data Generation
## 2 Related Work  
[PERSON] et al. [7] presented some methods to help generate sufficient data for training machine learning models for intrusion detection. They generated artificial attack data using machine learning methods and assessed the quality of the data using different techniques. They showed that synthetic data can help improve the performance of machine-learning-based IDS when used in combination with real-world data. They used two methods in attack data generation. The first method assumes that only benign data are available with no attack instances, where the features follow a normal distribution and a feature value out of the range \((\mu-3\delta,\mu+3\delta)\) is considered abnormal. A data sample is altered by changing the feature values to values that are out of the normal mean (\(\mu\)) and standard deviation (\(\delta\)) range [7]. The algorithm calculates the mean and standard deviation of each feature value in the benign dataset. Then, it generates a number of samples by randomly selecting a sample from the benign data, copying it, and altering the values of its features so that the generated sample is different enough from the benign data. This method can be used in attack data generation; however, since the attack values are generated based on mean and variance, attacks can easily be detected by a machine learning model. It is important to consider more sophisticated attacks that manipulate data in a non-easily detectable manner so that the trained IDS is powerful enough. In the second method, the authors generated more attack data using a dataset containing a small number of intrusive samples. This method involves generating new synthetic samples by copying and slightly modifying a randomly selected sample from the previously collected attack dataset. The assumption behind this method is that future attack instances are often similar to past attack instances, even if they are not identical. The algorithm randomly selects a feature and a sample from the previously collected attack dataset, and then calculates the highest frequency of values for the selected feature \((Vmax)\) and the frequency of the value of the selected feature in the selected sample \((V)\). The algorithm generates \((Vmax-V)\) new synthetic samples by copying the selected sample and altering the value of the selected feature within a small range to ensure that the new sample is similar to the previous ones in the attack dataset. They observed that generating synthetic attack data using the proposed method helped improve the classification accuracy of machine learning models [7]. [PERSON] et al. [8] focused on developing a secure inter-car network called VANET (vehicular ad hoc network), which allows for wireless connection between vehicles and infrastructure and between vehicles themselves. This network aims to ensure convenience and safety when using the road. Its security had to be reinforced to avoid any malfunctions or infiltration into the system. The study suggests that, in order to build a highly effective intrusion detection system (IDS) for VANET, the IDS has to be trained using a sufficient number of samples of security threats which VANET has not yet produced. They therefore used a network simulator called NS-3 to investigate different attacks directed at VANET. This simulation is able to generate synthetic datasets consisting of cyber attack samples that can be used to train a machine-learning-based VANET IDS. This dataset can also be used to study the behavior and patterns of a vehicle targeted by an attacker by analyzing the traffic and network hosts [8]. [PERSON] et al. [9] presented a method for generating attack data that simulates stealthy sensor attacks in industrial control systems (ICS). The study assumes that an attacker has infiltrated the ICS and has taken control of a subset of sensors, and that the attacker is able to impersonate the compromised sensors without being detected. In this method, \"micro-distortions\" are injected into original sensor readings, thus sending out fake readings.