{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T11:06:24Z","timestamp":1790075184670,"version":"4.0.1"},"reference-count":49,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2026,9,20]],"date-time":"2026-09-20T00:00:00Z","timestamp":1789862400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Information and Communications Technology Planning and Evaluation","award":["RS-2024-00354169"],"award-info":[{"award-number":["RS-2024-00354169"]}]},{"name":"Graduate School of Security Convergence (AI), Gachon University","award":["RS-2026-25585348"],"award-info":[{"award-number":["RS-2026-25585348"]}],"id":[{"id":"https:\/\/ror.org\/03ryywt80","id-type":"ROR","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Anomaly detection systems for detecting cyber threats in industrial control systems (ICSs) can suffer performance degradation because rare normal samples may not be sufficiently learned. To address this problem, various data augmentation methods have been studied. However, existing methods may generate data in unknown regions based on model decision boundaries or unnecessarily augment regions that already contain sufficient samples. Many existing methods also require anomalous data. To address these limitations, we propose Tail-Guided Low-Density Normal Data Augmentation (TGLDA), which operates using only normal data. TGLDA consists of a low-density region estimator and a data generator. It identifies low-density regions with relatively few samples in the observed data distribution and selectively augments these regions. TGLDA uses feature-tail seeds as heuristic starting points for generating samples in low-density regions. Experiments on a water treatment cybersecurity dataset show that TGLDA successfully generates data focused on low-density regions compared with other data augmentation methods. When each augmentation method was applied to baseline anomaly detection models, TGLDA achieved the highest Accuracy and F1-score across all models. These results show that TGLDA can mitigate problems caused by a lack of rare normal samples in real-world ICS environments where only normal data are available.<\/jats:p>","DOI":"10.3390\/s26185948","type":"journal-article","created":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T10:21:48Z","timestamp":1790072508000},"page":"5948","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["TGLDA: Tail-Guided Low-Density Normal Data Augmentation for Industrial Control Systems"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-9307-5704","authenticated-orcid":false,"given":"JuHyeon","family":"Lee","sequence":"first","affiliation":[{"name":"Department of Information Security, Gachon University, Seongnam-daero 1342, Seongnam-si 13119, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"data-curation","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-9027-1305","authenticated-orcid":false,"given":"Ilhwan","family":"Ji","sequence":"additional","affiliation":[{"name":"Department of Information Security, Gachon University, Seongnam-daero 1342, Seongnam-si 13119, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7116-6062","authenticated-orcid":false,"given":"Seungho","family":"Jeon","sequence":"additional","affiliation":[{"name":"Department of Smart Security, Gachon University, Seongnam-daero 1342, Seongnam-si 13119, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"},{"role":"project-administration","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0971-8548","authenticated-orcid":false,"given":"Jung Taek","family":"Seo","sequence":"additional","affiliation":[{"name":"Department of Smart Security, Gachon University, Seongnam-daero 1342, Seongnam-si 13119, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"validation","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"resources","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"},{"role":"project-administration","vocabulary":"credit"},{"role":"funding-acquisition","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,20]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Knapp, E.D., and Langill, J.T. (2014). Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems, Syngress.","DOI":"10.1016\/B978-0-12-420114-9.00007-1"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"101677","DOI":"10.1016\/j.cose.2019.101677","article-title":"Cybersecurity for industrial control systems: A survey","volume":"89","author":"Bhamare","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Seo, J.K., Lee, J., Kim, B., Shim, W., and Seo, J.T. (2026). AI-based anomaly detection in industrial control and cyber\u2013physical systems: A data-type-oriented systematic review. Electronics, 15.","DOI":"10.3390\/electronics15010020"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Ahmed, C.M., MR, G.R., and Mathur, A.P. (2020, January 6). Challenges in machine learning based approaches for real-time anomaly detection in industrial control systems. Proceedings of the 6th ACM on Cyber-Physical System Security Workshop, Online.","DOI":"10.1145\/3384941.3409588"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Kim, H., Mok, J., Lee, H., Shin, J., and Yoon, S. (2026, January 20\u201327). CANDI: Curated test-time adaptation for multivariate time-series anomaly detection under distribution shift. Proceedings of the AAAI Conference on Artificial Intelligence, Singapore EXPO, Singapore.","DOI":"10.1609\/aaai.v40i17.38524"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"2927","DOI":"10.1007\/s11263-024-02323-0","article-title":"Hard-normal example-aware template mutual matching for industrial anomaly detection","volume":"133","author":"Chen","year":"2025","journal-title":"Int. J. Comput. Vis."},{"key":"ref_7","unstructured":"Do, H.K.N., Nguyen, T., Hassanaly, M., Alharbi, R., Seo, J., and Thai, M. (2025, January 24\u201328). Swift hydra: Self-reinforcing generative framework for anomaly detection with multiple mamba models. Proceedings of the International Conference on Learning Representations, Singapore EXPO, Singapore. Available online: https:\/\/proceedings.iclr.cc\/paper_files\/paper\/2025\/hash\/8da04a60948be713dc766f0c7e3a5b1f-Abstract-Conference.html."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"706","DOI":"10.1109\/TII.2025.3609080","article-title":"Effective Sample Generation for Industrial Control Systems: A GAN-Based Approach","volume":"22","author":"Qin","year":"2026","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Choi, S., Yun, J.H., and Kim, S.K. (2018, January 24\u201326). A comparison of ICS datasets for security research based on attack paths. Proceedings of the International Conference on Critical Information Infrastructures Security, Kaunas, Lithuania.","DOI":"10.1007\/978-3-030-05849-4_12"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1080\/23742917.2020.1843822","article-title":"Design considerations for building credible security testbeds: Perspectives from industrial control system use cases","volume":"5","author":"Ani","year":"2021","journal-title":"J. Cyber Secur. Technol."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Tawfik, M., and Badawy, W. (2025, January 28\u201331). Adversarial Generation of Modbus TCP Packets Using WGANs for ICS Security Testing. Proceedings of the 2025 International Telecommunications Conference (ITC-Egypt), Cairo, Egypt.","DOI":"10.1109\/ITC-Egypt66095.2025.11186573"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Wu, X., and Kumar, V. (2009). kNN: k-Nearest neighbors. The Top Ten Algorithms in Data Mining, Chapman and Hall\/CRC.","DOI":"10.1201\/9781420089653"},{"key":"ref_13","unstructured":"Haarnoja, T., Zhou, A., Abbeel, P., and Levine, S. (2018, January 10\u201315). Soft actor-critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor. Proceedings of the International Conference on Machine Learning, Stockholm, Sweden. Available online: https:\/\/proceedings.mlr.press\/v80\/haarnoja18b.html."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Zhang, L., and Zheng, X. (2024). Enhanced intrusion detection for ICS using MS1DCNN and transformer to tackle data imbalance. Sensors, 24.","DOI":"10.3390\/s24247883"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"9793","DOI":"10.1007\/s00521-022-06965-4","article-title":"DEIDS: A novel intrusion detection system for industrial control systems","volume":"34","author":"Gu","year":"2022","journal-title":"Neural Comput. Appl."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"41874","DOI":"10.1109\/ACCESS.2022.3167814","article-title":"Industrial control system anomaly detection and classification based on network traffic","volume":"10","author":"Jiang","year":"2022","journal-title":"IEEE Access"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Li, C., Li, F., Zhang, L., Yang, A., Hu, Z., and He, M. (2023). Intrusion detection for industrial control systems based on improved contrastive learning SimCLR. Appl. Sci., 13.","DOI":"10.3390\/app13169227"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"206","DOI":"10.1016\/j.comcom.2021.04.014","article-title":"Attack sample generation algorithm based on data association group by GAN in industrial control dataset","volume":"173","author":"Zhou","year":"2021","journal-title":"Comput. Commun."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"768","DOI":"10.1016\/j.future.2022.12.024","article-title":"A data balancing approach based on generative adversarial network","volume":"141","author":"Yuan","year":"2023","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Sha, Y., Chen, Z., Liu, X., Yan, Y., Du, C., Liu, J., and Han, R. (2022). Adaptive industrial control system attack sample expansion algorithm based on generative adversarial network. Appl. Sci., 12.","DOI":"10.3390\/app12178889"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Cai, Z., Du, H., Wang, H., Zhang, J., Si, Y., and Li, P. (2023). One-dimensional convolutional Wasserstein generative adversarial network based intrusion detection method for industrial control systems. Electronics, 12.","DOI":"10.3390\/electronics12224653"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Han, C., and Gim, G. (2025). Time-series-based anomaly detection in industrial control systems using generative adversarial networks. Processes, 13.","DOI":"10.3390\/pr13092885"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Feng, S., Gao, L., and Shi, L. (2025). CGFL: A robust federated learning approach for intrusion detection systems based on data generation. Appl. Sci., 15.","DOI":"10.3390\/app15052416"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"2580","DOI":"10.1007\/s12559-024-10283-3","article-title":"Generative model-driven synthetic training image generation: An approach to cognition in railway defect detection","volume":"16","author":"Ferdousi","year":"2024","journal-title":"Cogn. Comput."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Jeon, S., and Seo, J.T. (2024). A synthetic time-series generation using a variational recurrent autoencoder with an attention mechanism in an industrial control system. Sensors, 24.","DOI":"10.3390\/s24010128"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"14131","DOI":"10.1109\/TPAMI.2023.3303099","article-title":"Adversarial data augmentation for hmm-based anomaly detection","volume":"45","author":"Castellini","year":"2023","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_27","first-page":"102717","article-title":"Adversarial attacks on machine learning cybersecurity defences in industrial control systems","volume":"58","author":"Anthi","year":"2021","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Mustafa, A., Khan, M.T., Umer, M.A., Masood, Z., and Ahmed, C.M. (2025, January 6). Adversarial sample generation for anomaly detection in industrial control systems. Proceedings of the 1st Workshop on Modeling and Verification for Secure and Performant Cyber-Physical Systems, Irvine, CA, USA.","DOI":"10.1145\/3735948.3736158"},{"key":"ref_29","unstructured":"Lovric, M. (2025). Kullback\u2013Leibler divergence. International Encyclopedia of Statistical Science, Springer. [2nd ed.]."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"012112","DOI":"10.1088\/1742-6596\/1566\/1\/012112","article-title":"Comparative analysis of inter-centroid K-Means performance using euclidean distance, canberra distance and manhattan distance","volume":"1566","author":"Faisal","year":"2020","journal-title":"J. Phys. Conf. Ser."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Liberti, L., and Lavor, C. (2017). Euclidean Distance Geometry: An Introduction, Springer International Publishing.","DOI":"10.1007\/978-3-319-60792-4"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Raju, V.G., Lakshmi, K.P., Jain, V.M., Kalidindi, A., and Padma, V. (2020, January 20\u201322). Study the influence of normalization\/transformation process on the accuracy of supervised classification. Proceedings of the 2020 Third International Conference on Smart Systems and Inventive Technology (ICSSIT), Tirunelveli, India.","DOI":"10.1109\/ICSSIT48917.2020.9214160"},{"key":"ref_33","unstructured":"Hospodarskyy, O., Martsenyuk, V., Kukharska, N., Hospodarskyy, A., and Sverstiuk, S. (2024, January 12\u201314). Understanding the Adam Optimization Algorithm in Machine Learning. Proceedings of the 2nd International Workshop on Computer Information Technologies in Industry 4.0 (CITI 2024), Ternopil, Ukraine. Available online: https:\/\/ceur-ws.org\/Vol-3742\/paper17.pdf."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1002\/psp4.12161","article-title":"Model evaluation of continuous data pharmacometric models: Metrics and graphics","volume":"6","author":"Nguyen","year":"2017","journal-title":"CPT Pharmacomet. Syst. Pharmacol."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Becerra-Suarez, F.L., Alvarez-Vasquez, H., and Forero, M.G. (2025). Improvement of bank fraud detection through synthetic data generation with Gaussian noise. Technologies, 13.","DOI":"10.3390\/technologies13040141"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Wan, Z., Zhang, Y., and He, H. (December, January 27). Variational autoencoder based synthetic data generation for imbalanced learning. Proceedings of the 2017 IEEE Symposium Series on Computational Intelligence (SSCI), Honolulu, HI, USA.","DOI":"10.1109\/SSCI.2017.8285168"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Figueira, A., and Vaz, B. (2022). Survey on synthetic data generation, evaluation methods and GANs. Mathematics, 10.","DOI":"10.3390\/math10152733"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"4293","DOI":"10.1109\/TKDE.2021.3140058","article-title":"Time series anomaly detection with adversarial reconstruction networks","volume":"35","author":"Liu","year":"2023","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Li, D., Chen, D., Jin, B., Shi, L., Goh, J., and Ng, S.K. (2019, January 17\u201319). MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks. Proceedings of the International Conference on Artificial Neural Networks, Munich, Germany.","DOI":"10.1007\/978-3-030-30490-4_56"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"5719","DOI":"10.1007\/s41060-025-00810-2","article-title":"ALGAN: Time series anomaly detection with Adjusted-LSTM GAN","volume":"20","author":"Bashar","year":"2025","journal-title":"Int. J. Data Sci. Anal."},{"key":"ref_41","first-page":"88","article-title":"A dataset to support research in the design of secure water treatment systems","volume":"Volume 10242","author":"Goh","year":"2017","journal-title":"Proceedings of the International Conference on Critical Information Infrastructures Security, Paris, France,\n           10\u201312 October 2016"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"8897926","DOI":"10.1155\/2020\/8897926","article-title":"Anomaly detection for industrial control system based on autoencoder neural network","volume":"2020","author":"Wang","year":"2020","journal-title":"Wirel. Commun. Mob. Comput."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Feng, C., Li, T., and Chana, D. (2017, January 26\u201329). Multi-level anomaly detection in industrial control systems via package signatures and LSTM networks. Proceedings of the 2017 47th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), Denver, CO, USA.","DOI":"10.1109\/DSN.2017.34"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"100393","DOI":"10.1016\/j.ijcip.2020.100393","article-title":"A multilayer perceptron model for anomaly detection in water treatment plants","volume":"31","author":"MR","year":"2020","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"5459452","DOI":"10.1155\/2024\/5459452","article-title":"An efficient anomaly detection method for industrial control systems: Deep convolutional autoencoding transformer network","volume":"2024","author":"Shang","year":"2024","journal-title":"Int. J. Intell. Syst."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"419","DOI":"10.1002\/bimj.200710415","article-title":"Youden Index and optimal cut-point estimated from observations affected by a lower limit of detection","volume":"50","author":"Ruopp","year":"2008","journal-title":"Biom. J."},{"key":"ref_47","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Hinton","year":"2008","journal-title":"J. Mach. Learn. Res."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"161","DOI":"10.1080\/24709360.2017.1396742","article-title":"A tutorial on kernel density estimation and recent advances","volume":"1","author":"Chen","year":"2017","journal-title":"Biostat. Epidemiol."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"433","DOI":"10.1002\/wics.101","article-title":"Principal component analysis","volume":"2","author":"Abdi","year":"2010","journal-title":"Wiley Interdiscip. Rev. Comput. Stat."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5948\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T10:31:31Z","timestamp":1790073091000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5948"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,20]]},"references-count":49,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26185948"],"URL":"https:\/\/doi.org\/10.3390\/s26185948","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,20]]}}}