## 5 Experiments and Assumptions on Abnormal Behavior Detection and Noise Removal Performance
### Evaluation of Attack Detection Performance and Ability to Trend Reflection
On the other hand, in the accuracy graph of Figure 5, the proposed method shows low accuracy in the first 0-20 fold periods. This result means that the number of data was insufficient to reflect the pattern of new data. However, in the data after the 20 th fold, the classification accuracies of the proposed method and the ideal approach show similar performances. This means that a sufficient number of pure data to learn the model's decision boundary effectively has been organized. In other words, this experiment shows that the proposed method can effectively train a classification model even with a small amount of data if repeated learning is performed for a sufficiently long time. As a result of these, in Figures 4 and 6, the proposed method shows a more effective learning time than the ideal approach. Figure 4: Training time per unit data input of the proposed method and the ideal method when the size of the pure dataset is 20,000. Figure 5: Attack classification accuracy of the proposed and ideal methods when the size of the pure dataset is 20,000 and the proportion of attack data is reduced. Figure 3: Attack classification accuracy of the proposed method and the ideal method when the size of the pure dataset is 20,000. Figures 7 and 8 are the attack detection results for a 40,000-scale training dataset generated by the proposed method, and Figures 9 and 10 are experiments that reduced the proportion of attack data to 20%. In the attack classification accuracy graph of Figure 7, where the change in data trends is significant, the difference in attack classification performance between the ideal approach and the proposed method is not significant. These results imply that it may not be appropriate to operate a training set of 40,000 for a given dataset. Similarly, in Figure 9, where the change in the data trend is small, the proposed method shows similar attack classification accuracy to the ideal approach up to about 50 th fold intervals. However, the proposed method shows higher accuracy than the ideal approach after the 75 th fold, where the last attack data is observed. This means that the proposed method eliminated noise data properly while at the same time enabling more accurate classification than the ideal approach in the period where the data pattern changes from attack to normal. In addition, the average classification accuracy measured by the method proposed in Figures 7 and 9 is higher than the accuracy of Figures 3 and 5. These results imply that considering the feature and distribution of each data in a given dataset, and its more appropriate to operate 40,000 training sets than 20,000 training sets. As a result, if the learning dataset's size can be adequately set considering the number of newly observed data and the number of data that can be digested every unit training time interval, the proposed method shows higher attack detection performance than simply learning large amounts of data. Figures 7 and 8 show the experimental results of setting the size of the training dataset generated by the proposed method to 40,000. Figures 9 and 10 show the experiment results in which the ratio of attack data was reduced to the level of 20%. In the attack classification accuracy graph of Figure 7, where the data trend changes, the ideal method has slightly higher overall detection performance, and the proposed method generates fewer false alarms in the last section by removing the noise data. In this experiment, the difference in accuracy between the proposed method and the ideal method is not significant in all folds. This result means that as the size of the training dataset of the proposed method increases, the two methodologies converge in the direction of deriving similar results. In Figure 9, where the change in data trend is small, the proposed method shows attack classification accuracy similar to the ideal method up to about 50 folds. However, after the 75 th fold, where the last attack data is observed, the proposed method shows higher accuracy than the ideal method.