Find research datasets worth reusing
Search datasets from major research repositories and use ShareScore to quickly assess how well each record supports discovery, access, and reuse.
19
datasets available to search
ShareScore release 0.9.0
Dataset results
19 results for “intrusion detection”
HIKARI-2021: Generating Network Intrusion Detection Dataset Based on Real and Encrypted Synthetic Attack Traffic
<p>Available datasets from the paper Generating Encrypted Network Traffic for Intrusion Detection Datasets.</p> <p>To produce the dataset follow the technical detail in <a href="https://github.com/andreysfc/generating-encrypted-network">github</a></p>
Federated Learning for Distributed Intrusion Detection Systems in Public Networks - Validation Dataset
<p>This dataset has been meticulously prepared and utilized as a validation set during the evaluation phase of "Meta IDS" to asses the performance of various machine learning models. It is now made available for interested users and researchers who seek a reliable and diverse dataset for training and testing their own custom models.</p> <p>The validation dataset comprises a comprehensive collection of labeled entries, that determines whether the packet type is "malicious" or "benign." It covers complex design patterns that are commonly encountered in real-world applications. The dataset is designed to be representative, encompassing edge and fog layers that are in contact with cloud layer, thereby enabling thorough testing and evaluation of different models. Each sample in the dataset is labeled with the corresponding ground truth, providing a reliable reference for model performance evaluation.</p> <p> </p> <p>To ensure convenient distribution and storage, the dataset has been broken down into three separate batches, each containing a portion of the dataset. This allows for convenient downloading and management of the dataset. The three batches are provided as individual compressed files.</p> <p> </p> <p>In order to extract the data, follow the following instructions:</p> <ul> <li>Download and install bzip2 (if not already installed) from the official website or your package manager.</li> <li>Place the compressed dataset file in a directory of your choice.</li> <li>Open a terminal or command prompt and navigate to the directory where the compressed dataset file is located.</li> <li>Execute the following command to uncompress the dataset: <ul> <li>bzip2 -d filename.bz2</li> </ul> </li> <li>Replace "filename.bz2" with the actual name of the compressed dataset file.</li> </ul> <p>Once uncompressed, you will have access to the dataset in its original format for further exploration, analysis, and model training etc. The total storage required for extraction is approximately 800 GB in total, with the first batch requiring approximately 302 GB, the second batch requiring approximately 203 GB, and the third batch requiring approximately 297 GB of data storage.</p> <p> </p> <p>The first batch contains 1,049,527,992 entries, where as the second batch contains 711,043,331 entries, and for the third and last batch we have 1,029,303,062 entries. The following table provides the feature names along with their explanation and example value once the dataset is extracted.</p> <p> </p> <table align="left"> <thead> <tr> <th scope="col">Feature</th> <th scope="col">Description</th> <th scope="col">Example Value</th> </tr> </thead> <tbody> <tr> <td>ip.src</td> <td>Source IP address in the packet</td> <td>a05d4ecc38da01406c9635ec694917e969622160e728495e3169f62822444e17</td> </tr> <tr> <td>ip.dst</td> <td>Destination IP address in the packet</td> <td>a52db0d87623d8a25d0db324d74f0900deb5ca4ec8ad9f346114db134e040ec5</td> </tr> <tr> <td>frame.time_epoch</td> <td>Epoch time of the frame</td> <td>1676165569.930869</td> </tr> <tr> <td>arp.hw.type</td> <td>Hardware type</td> <td>1</td> </tr> <tr> <td>arp.hw.size</td> <td>Hardware size</td> <td>6</td> </tr> <tr> <td>arp.proto.size</td> <td>Protocol size</td> <td>4</td> </tr> <tr> <td>arp.opcode</td> <td>Opcode</td> <td>2</td> </tr> <tr> <td>data.len</td> <td>Length</td> <td>2713</td> </tr> <tr> <td>eth.dst.lg</td> <td>Destination LG bit</td> <td>1</td> </tr> <tr> <td>eth.dst.ig</td> <td>Destination IG bit</td> <td>1</td> </tr> <tr> <td>eth.src.lg</td> <td>Source LG bit</td> <td>1</td> </tr> <tr> <td>eth.src.ig</td> <td>Source IG bit</td> <td>1</td> </tr> <tr> <td>frame.offset_shift</td> <td>Time shift for this packet</td> <td>0</td> </tr> <tr> <td>frame.len</td> <td>frame length on the wire</td> <td>1208</td> </tr> <tr> <td>frame.cap_len</td> <td>Frame length stored into the capture file</td> <td>215</td> </tr> <tr> <td>frame.marked</td> <td>Frame is marked</td> <td>0</td> </tr> <tr> <td>frame.ignored</td> <td>Frame is ignored</td> <td>0</td> </tr> <tr> <td>frame.encap_type</td> <td>Encapsulation type</td> <td>1</td> </tr> <tr> <td>gre</td> <td>Generic Routing Encapsulation</td> <td>'Generic Routing<br> Encapsulation (IP)’</td> </tr> <tr> <td>ip.version</td> <td>Version</td> <td>6</td> </tr> <tr> <td>ip.hdr_len</td> <td>Header length</td> <td>24</td> </tr> <tr> <td>ip.dsfield.dscp</td> <td>Differentiated Services<br> Codepoint</td> <td>56</td> </tr> <tr> <td>ip.dsfield.ecn</td> <td>Explicit Congestion<br> Notification</td> <td>2</td> </tr> <tr> <td>ip.len</td> <td>Total length</td> <td>614</td> </tr> <tr> <td>ip.flags.rb</td> <td>Reserved bit</td> <td>0</td> </tr> <tr> <td>ip.flags.df</td> <td>Don't fragment</td> <td>1</td> </tr> <tr> <td>ip.flags.mf</td> <td>More fragments</td> <td>0</td> </tr> <tr> <td>ip.frag_offset</td> <td>Fragment offset</td> <td>0</td> </tr> <tr> <td>ip.ttl</td> <td>Time to live</td> <td>31</td> </tr> <tr> <td>ip.proto</td> <td>Protocol</td> <td>47</td> </tr> <tr> <td>ip.checksum.status</td> <td>Header checksum status</td> <td>2</td> </tr> <tr> <td>tcp.srcport</td> <td>TCP source port</td> <td>53425</td> </tr> <tr> <td>tcp.flags</td> <td>Flags</td> <td>0x00000098</td> </tr> <tr> <td>tcp.flags.ns</td> <td>Nonce</td> <td>0</td> </tr> <tr> <td>tcp.flags.cwr</td> <td>Congestion Window Reduced<br> (CWR)</td> <td>1</td> </tr> <tr> <td>udp.srcport</td> <td>UDP source port</td> <td>64413</td> </tr> <tr> <td>udp.dstport</td> <td>UDP destination port</td> <td>54087</td> </tr> <tr> <td>udp.stream</td> <td>Stream index</td> <td>1345</td> </tr> <tr> <td>udp.length</td> <td>Length</td> <td>225</td> </tr> <tr> <td>udp.checksum.status</td> <td>Checksum status</td> <td>3</td> </tr> <tr> <td>packet_type</td> <td>Type of the packet which is either "benign" or "malicious"</td> <td>0</td> </tr> </tbody> </table> <p>Furthermore, in compliance with the GDPR and to ensure the privacy of individuals, all IP addresses present in the dataset have been anonymized through hashing. This anonymization process helps protect the identity of individuals while preserving the integrity and utility of the dataset for research and model development purposes.</p> <p> </p> <p>Please note that while the dataset provides valuable insights and a solid foundation for machine learning tasks, it is not a substitute for extensive real-world data collection. However, it serves as a valuable resource for researchers, practitioners, and enthusiasts in the machine learning community, offering a compliant and anonymized dataset for developing and validating custom models in a specific problem domain.</p> <p> </p> <p>By leveraging the validation dataset for machine learning model evaluation and custom model training, users can accelerate their research and development efforts, building upon the knowledge gained from my thesis while contributing to the advancement of the field.</p>
Wintertime Arctic warm air intrusion detection algorithm for satellite sea ice concentration analysis
<p>This Dataset is related to the Article <em>Relevance of warm air intrusions for Arctic satellite sea ice concentration time </em>series in <em>The Cryosphere</em> (https://doi.org/10.5194/tc-2023-69).</p> <p>Provided are the core detection algorithm and a minimal working example as well as a list of all detected warm air intrusions between November 1979 and April 2020 (monthly data).</p>
Dragon_Pi: IoT Side-Channel Power Data Intrusion Detection Dataset and Unsupervised Convolutional Autoencoder for Intrusion Detection
<h2><strong>Dragon_Pi</strong></h2> <div> <div>For a more in depth description of the Dragon_Pi dataset, please consult the journal article of the same name:</div> <div>Lightbody <em>et al.</em>, Future Internet, 2024, <a href="https://doi.org/10.3390/fi16030088">https://doi.org/10.3390/fi16030088</a> - specifically Section 3.2: Dataset Overview.</div> <div> </div> </div> <p>Dragon_Pi is an intrusion detection dataset for IoT devices. In the field of IoT security there are few datasets, and those which do exist tend to focus solely on network traffic. The Dragon_Pi dataset seeks to provide not only more data for the field of IoT security, but also, data of a somewhat under-published type: linear time series power consumption data.</p> <p>Dragon_Pi is a fully labelled Intrusion Detection dataset for IoT devices. It is composed of both normal and under-attack power consumption data obtained from two separate testbeds - one using a DragonBoard 410c and the other a Raspberry Pi Model 3 - Hence the moniker <em>Dragon_Pi</em>. </p> <p>These testbeds were set up with predefined normal behavour as described in the attached publications. The normal linear time series power consumption was sampled from the testbed under these normal conditions. Both testbeds were then attacked using some common attacks on IoT - the linear time series power consumption captured under these condtions as well. </p> <p>Specifically, the testbeds were subjected to the Port Scan (using Nmap), SSH Brute Force (using Hydra) and SYNFlood Denial of Service (using Hping3) attacks. These attacks were repeated to gain insight to what their signatures looked like and also how varying the tool settings effected the resultant signature. A fourth type of scenario was also conducted on the testbeds - the "Capture the Flag" scenarios. In these files multiple attack types were used with a more specific target - to exfiltrate a hidden file from the testbeds.</p> <p>Each file has three hierarchical levels of annotation for <strong>each sample</strong> within:</p> <ol> <li>A simple "Normal or Anomaly" label for the specific sample</li> <li>A specifc attack type label e.g. "SSH Bruteforce", for the specific sample</li> <li>A specific tool setting for that attack e.g. "Hydra_T16", for the specific sample</li> </ol> <p>Users can decide for themselves what level of annotation they require for their specific task. </p> <p>Each file in the Dragon_Pi dataset is accompanied by its own legend file. This file explains the contents of the specific .csv file and the specific indexes of the events within.</p> <p>The Dragon_Pi dataset consists of approximately 67 files, as shown in Table 1. Compressed, the datset totals approximately 13GB. Completely decompressed the dataset is approximately 80GB ( 30GB Pi data, 50 GB Dragon data). </p> <div> </div> <div> <table> <tbody> <tr> <td>Label Type</td> <td>Specific Label </td> <td>Number of Files DragonBoard 410c</td> <td>Number of Files Raspberry Pi</td> </tr> <tr> <td>Normal </td> <td>Normal </td> <td>3 </td> <td>2</td> </tr> <tr> <td>Port Scan Attack </td> <td>Nmap_T5</td> <td>2</td> <td>1</td> </tr> <tr> <td> </td> <td>Nmap_T4</td> <td>1</td> <td>1</td> </tr> <tr> <td> </td> <td>Nmap_T3</td> <td>1</td> <td>1</td> </tr> <tr> <td> </td> <td>Nmap_T2</td> <td>1</td> <td>1</td> </tr> <tr> <td>SSH Brute Force</td> <td>Hydra_T32</td> <td>4</td> <td>2</td> </tr> <tr> <td> </td> <td>Hydra_T16</td> <td>16</td> <td>2</td> </tr> <tr> <td> </td> <td>Hydra_T3</td> <td>8</td> <td>2</td> </tr> <tr> <td> </td> <td>Hydra_T1</td> <td>5</td> <td>2</td> </tr> <tr> <td>SYNFlood DOS</td> <td>SYNFlood DOS</td> <td>1</td> <td>1</td> </tr> <tr> <td>Capture the Flag</td> <td>Misc Attacks</td> <td>3</td> <td>5</td> </tr> </tbody> </table> </div> <div>Table 1. Enumeration of the in the Dragon_Pi dataset.</div> <div> </div> <div> </div> <div>For a more in depth description of the Dragon_Pi dataset, please consult the journal article of the same name:</div> <div>Lightbody <em>et al.</em>, Future Internet, 2024, <a href="https://doi.org/10.3390/fi16030088">https://doi.org/10.3390/fi16030088</a> - specifically Section 3.2: Dataset Overview.</div> <div> </div> <div> </div> <div><strong>Publication of this dataset:</strong></div> <div> </div> <div>This dataset was published in Lightbody <em>et al.</em>, Future Internet, 2024, <a href="https://doi.org/10.3390/fi16030088">https://doi.org/10.3390/fi16030088</a>. Consult and cite this article for a more in depth dataset description, as well as an in depth review of first AI Intrusion Detection model trained on this dataset. </div> <div> </div> <div>See article Lightbody <em>et al.</em>, Future Internet, 2023, <a href="https://doi.org/10.3390/fi15050187">https://doi.org/10.3390/fi15050187</a> for a detailed investigation on the attack signatures discovered while creating this dataset. This work was an inital investigation of the dataset and can serve as a part 1 to the Dragon_Pi paper.</div> <div> </div> <div> </div> <div><strong>How to cite this dataset in your work: </strong></div> <div> </div> <div>Please cite these two DOIs when publishing using this dataset:</div> <div> <ol> <li>Dragon_Pi release publication: <a href="https://doi.org/10.3390/fi16030088">https://doi.org/10.3390/fi16030088</a> (most important)</li> <li>Zenodo Dataset DOI: https://doi.org/10.5281/zenodo.10784947</li> </ol> </div> <div> <div> </div> </div> <p> </p>
Tagged original datasets for 'Genetically Optimized Massively Parallel Binary Neural Networks for Intrusion Detection Systems'
<p>Tagged, non-formatted, original datasets used in 'Genetically Optimized Massively Parallel Binary Neural Networks for Intrusion Detection Systems', T. Murovič, A. Trost.</p> <p>Available from the original authors:</p> <p>1. <a href="https://www.unsw.adfa.edu.au/unsw-canberra-cyber/cybersecurity/ADFA-NB15-Datasets/">https://www.unsw.adfa.edu.au/unsw-canberra-cyber/cybersecurity/ADFA-NB15-Datasets/</a> (UNWS-NB15 dataset)</p> <p>2. <a href="https://www.unb.ca/cic/datasets/nsl.html">https://www.unb.ca/cic/datasets/nsl.html</a> (NSL-KDD dataset)</p>
Farm-Flow | AG-IoT Security: Intrusion Detection in Smart Agriculture Dataset
<div> <div> <p><strong>Introduction:</strong></p> <p>The "Farm-Flow" dataset was created to emulate real-world Agricultural Internet of Things (AG-IoT) systems, encompassing network attacks and data collection. Following comprehensive cleaning and processing, the "Farm-Flow" dataset comprises 532 MB of data with 1,310,000 instances, structured around "flows," which represent consecutive series of packets transmitted from a single source to a specific destination. The dataset demonstrates an intrusion detection accuracy of 92.67% and is intended to enhance the security of AG-IoT systems, safeguarding information such as crop health, weather patterns, and soil conditions</p> <p><strong>Captures:</strong></p> <p>The captures comprises three months of network traffic: August, September, and October of 2022. Each month is divided into folders, which categorize the network traffic. These folders contain numerous .pcap files, which have been divided into 5-second intervals. This segmentation is necessary because, as previously mentioned, flows aggregate packets, resulting in only one row of flow data for ongoing connections. To address this, a script was developed to segment the .pcap files into 5-second increments. This approach allows for the generation of multiple rows of flow connections, thereby providing more quantity of data for model training.</p> <p><strong>Dataset:</strong></p> <p>The dataset comprises 532 MB of data, encompassing 1,310,000 instances. These instances have been classified into eight distinct attack types and one category for normal traffic. The identified attacks include Arp Spoofing, BotNet DDoS, HTTP Flood, ICMP Flood, MQTT Flood, Port Scanning, TCP Flood, and UDP Flood. Among the data set, there are 27,458 instances of normal traffic and 1,282,429 instances of aggregated attack traffic.</p> <p><strong>Zip Folder:</strong></p> <p>The zip folder is structured into two main directories: Captures and Dataset. The Captures directory is organized by the month of capture and further categorized by network traffic type. The Datasets directory includes the Farm-Flow Dataset, alongside four additional datasets that have undergone pre-processing: the training and testing datasets for binary classification, and the training and testing datasets for multiclass classification. Additionally, there are further datasets categorized by month and type of network traffic.</p> <p><strong> Article Information:</strong></p> <p>The work involved in developing the Farm-Flow dataset is described in the following paper. Please cite the paper and the dataset when using the Farm-Flow dataset.</p> <blockquote> <p>Rafael Ferreira, Ivo Bispo, Carlos Rabadão, Leonel Santos, and Rogério Luís de C. Costa (2025). <em>Farm-flow dataset: Intrusion detection in smart agriculture based on network flows</em>, Computers and Electrical Engineering, Volume 121, 109892, DOI: <a href="https://doi.org/10.1016/j.compeleceng.2024.109892." target="_blank" rel="noopener"> 10.1016/j.compeleceng.2024.109892</a></p> </blockquote> </div> </div>
Artifact: SoK: Evaluations in Industrial Intrusion Detection Research
<p>This collection resembles the artifact of our publication "SoK: Evaluations in Industrial Intrusion Detection Research," published in the Journal of Systems Research 2023, in which we performed a systematic mapping study on the literature of Industrial Intrusion Detection Systems (IIDSs). Within this paper, we systematically analyzed the evaluation methodologies of this field to understand the current state of industrial intrusion detection research. This artifact contains our data extracted from the 609 publications under consideration in the survey. For further information, please refer to the respective publication.</p>
Systematic Review Dataset Collection for Intrusion Detection
Open the record for dataset details and reuse information.
Dataset used in Can process mining help in anomaly-based intrusion detection?
<p>This is the dataset used in the paper Can process mining help in anomaly-based intrusion detection?</p>
real time intrusion detection systems
<p>This repository includes data and results in chapter 5 of PhD thesis "A policy compliance detection architecture for data exchange infrastructures"</p>
IEC 60870-5-104 Intrusion Detection Dataset
<p><strong>IEC 60870-5-104</strong></p> <p><strong>Intrusion Detection Dataset</strong></p> <p><strong>Readme File</strong></p> <p>ITHACA – University of Western Macedonia - <a href="https://ithaca.ece.uowm.gr/">https://ithaca.ece.uowm.gr/</a></p> <p>Authors: Panagiotis Radoglou-Grammatikis, Thomas Lagkas, Vasileios Argyriou, Panagiotis Sarigiannidis</p> <p><strong>Publication Date:</strong> September 23, 2022</p> <p> </p> <p>1.Introduction</p> <p>The evolution of the Industrial Internet of Things (IIoT) introduces several benefits, such as real-time monitoring, pervasive control and self-healing. However, despite the valuable services, security and privacy issues still remain given the presence of legacy and insecure communication protocols like IEC 60870-5-104. IEC 60870-5-104 is an industrial protocol widely applied in critical infrastructures, such as the smart electrical grid and industrial healthcare systems. The IEC 60870-5-104 Intrusion Detection Dataset was implemented in the context of the research paper entitled "Modeling, Detecting, and Mitigating Threats Against Industrial Healthcare Systems: A Combined Software Defined Networking and Reinforcement Learning Approach" [1], in the context of two H2020 projects: ELECTRON: rEsilient and seLf-healed EleCTRical pOwer Nanogrid (101021936) and SDN-microSENSE: SDN - microgrid reSilient Electrical eNergy SystEm (833955). This dataset includes labelled Transmission Control Protocol (TCP)/Internet Protocol (IP) network flow statistics (Common-Separated Values (CSV) format) and IEC 60870-5-104 flow statistics (CSV format) related to twelve IEC 60870-5-104 cyberattacks. In particular, the cyberattacks are related to unauthorised commands and Denial of Service (DoS) activities against IEC 60870-5-104. Moreover, the relevant Packet Capture (PCAP) files are available. The dataset can be utilised for Artificial Intelligence (AI)-based Intrusion Detection Systems (IDS), taking full advantage of Machine Learning (ML) and Deep Learning (DL).</p> <p>2.Instructions</p> <p>The IEC 60870-5-104 dataset was implemented following the methodology of A. Gharib et al. in [2], including eleven features: (a) Complete Network Configuration, (b) Complete Traffic, (c) Labelled Dataset, (d) Complete Interaction, (e) Complete Capture, (f) Available Protocols, (g) Attack Diversity, (h) Heterogeneity, (i) Feature Set and (j) Metadata.</p> <p>A network topology consisting of (a) seven industrial entities, (b) one Human Machine Interfaces (HMI) and (c) three cyberattackers was used to construct the IEC 60870-5-104 Intrusion Detection Dataset. The industrial entities use IEC TestServer<a href="#_ftn1">[1]</a>, while the HMI uses Qtester104<a href="#_ftn2">[2]</a>. On the other hand, the cyberattackers use Kali Linux<a href="#_ftn3">[3]</a> equipped with Metasploit<a href="#_ftn4">[4]</a>, OpenMUC j60870<a href="#_ftn5">[5]</a> and Ettercap<a href="#_ftn6">[6]</a>. The cyberattacks were performed during the following days.</p> <ul> <li>On Saturday, April 25, 2020, a DoS cyberattack (M_SP_NA_1_DoS) was executed for 2 hours, using the M_SP_NA_1 command.</li> <li>On Sunday, April 26, 2020, two cyberattacks were executed, namely (a) DoS (C_CI_NA_1_DoS) and (b) unauthorised injection (C_CI_NA_1), using the C_CI_NA_1 command for 2 hours.</li> <li>On Monday, April 27, 2020, one unauthorised injection attack (C_SE_NA_1) was executed for 4 hours, using the C_SE_NA_1 command.</li> <li>Tuesday, April 28, 2020 two cyberattacks were executed, namely (a) unauthorised injection (C_SC_NA_1) and (b) DoS (C_SE_NA_1_DoS), using the C_SC_NA_1 and C_SE_NA_1 commands for 2 hours and 4 hours, respectively.</li> <li>Wednesday, April 29, 2020, one DoS (C_SC_NA_1) cyberattack was performed for 2 hours, using the C_SC_NA_1 command.</li> <li>Friday, June 05, 2020, two cyberattacks were executed, namely (a) DoS (C_RD_NA_1_DoS) and (b) unauthorised injection (C_RD_NA_1), using the C_RD_NA_1 command for 2 and 4 hours, respectively.</li> <li>Saturday, June 06, 2020, two cyberattacks were executed, namely (a) DoS (C_RP_NA_1_DoS) and (b) unauthorised injection (C_RP_NA_1), using the C_RP_NA_1 command for 2 and 4 hours, respectively.</li> <li>Monday, June 08, 2020, a Man In The Middle (MITM) cyberattack was executed for 2 hours, filtering and dropping the IEC 60870-5-104 packets.</li> </ul> <p>For each attack, a 7zip file is provided, including the network traffic and the network flow statistics for each entity. Moreover, a relevant diagram is provided, illustrating the corresponding cyberattack. In particular, for each entity, a folder is given, including (a) the relevant pcap file, (b) Transmission Control Protocol (TCP) / Internet Protocol (IP) network flow statistics in a Common Separated Value (CSV) format and (c) IEC 60870-5-104 flow statistics in a CSV format. The TCP/IP network flow statistics were generated by CICFlowMeter<a href="#_ftn7">[7]</a>, while the IEC 60870-5-104 flow statistics were generated based on a Custom IEC 60870-5-104 Python Parser<a href="#_ftn8">[8]</a>, taking full advantage of Scapy<a href="#_ftn9">[9]</a>.</p> <p>3.Dataset Structure</p> <p>The dataset consists of the following files:</p> <ul> <li><strong>20200425_UOWM_IEC104_Dataset_m_sp_na_1_DoS.7z</strong>: A 7zip file including the pcap and CSV files related to the M_SP_NA_1 attack.</li> <li><strong>20200426_UOWM_IEC104_Dataset_c_ci_na_1_DoS.7z</strong>: A 7zip file including the pcap and CSV files related to the C_CI_NA_1_DoS attack.</li> <li><strong>20200426_UOWM_IEC104_Dataset_c_ci_na_1.7z</strong>: A 7zip file including the pcap and CSV files related to C_CI_NA_1 attack.</li> <li><strong>20200427_UOWM_IEC104_Dataset_c_se_na_1.7z</strong>: A 7zip file including the pcap and CSV files related to the C_SE_NA_1 attack.</li> <li><strong>20200428_UOWM_IEC104_Dataset_c_sc_na_1.7z</strong>: A 7zip file including the pcap and CSV files related to the C_SC_NA_1 attack.</li> <li><strong>20200428_UOWM_IEC104_Dataset_c_se_na_1_DoS.7z</strong>: A 7zip file including the pcap and CSV files related to the C_SE_NA_1_DoS attack.</li> <li><strong>20200429_UOWM_IEC104_Dataset_c_sc_na_1_DoS.7z</strong>: A 7zip file including the pcap and CSV files related to the C_SC_NA_1_DoS attack.</li> <li><strong>20200605_UOWM_IEC104_Dataset_c_rd_na_1_DoS.7z</strong>: A 7zip file including the pcap and CSV files related to the C_RD_NA_1_DoS attack.</li> <li><strong>20200605_UOWM_IEC104_Dataset_c_rd_na_1.7z</strong>: A 7zip file including the pcap and CSV files related to the C_RD_NA_1 attack.</li> <li><strong>20200606_UOWM_IEC104_Dataset_c_rp_na_1_DoS.7z</strong>: A 7zip file including the pcap and CSV files related to the C_RP_NA_1_DoS attack.</li> <li><strong>20200606_UOWM_IEC104_Dataset_c_rp_na_1.7z</strong>: A 7zip file including the pcap and CSV files related to the C_RP_NA_1 attack.</li> <li><strong>20200608_UOWM_IEC104_Dataset_mitm_drop.7z</strong>: A 7zip file including the pcap and CSV files related to the MITM attack.</li> <li><strong>Balanced_IEC104_Train_Test_CSV_Files.zip</strong>: This zip file includes balanced CSV files from CICFlowMeter and the Custom IEC 60870-5-104 Python Parser that could be utilised for training ML and DL methods. The zip file includes different folders for the corresponding flow timeout values used for CICFlowMeter and IEC 60870-5-104 Python Parser, respectively.</li> </ul> <p>Each 7zip file includes respective folders related to the entities/devices (described in the following section) participating in each attack. In particular, for each entity/device, there is a folder including (a) the overall network traffic (pcap file) related to this entity/device during each attack, (b) the TCP/IP network flow statistics (CSV file) from CICFlowMeter for the overall network traffic, (c) the IEC 60870-5-104 network traffic (pcap file) related to this entity/device during each attack, (d) the TCP/IP network flow statistics (CSV file) from CICFlowMeter for the IEC 608770-5-104 network traffic, (e) the IEC 60870-5-104 flow statistics (CSV file) from the Custom IEC 60870-5-104 Python Parser for the IEC 608770-5-104 network traffic and finally, (f) an image showing how the attack was executed. Finally, it is noteworthy that the network flow from both CICFlowMeter and Custom IEC 60870-5-104 Python Parser in each CSV file are <strong>labelled</strong> based on the IEC 60870-5-104 cyberattacks executed for the generation of this dataset. The description of these attacks is given in the following section, while the various features from CICFlowMeter and Custom IEC 60870-5-104 Python Parser are presented in Section 5.</p> <p>4.Testbed & IEC 60870-5-104 Attacks</p> <p>The testbed created for generating this dataset is composed of five virtual RTU devices emulated by IEC TestServer and two real RTU devices. Moreover, there is another workstation which plays the role of Master Terminal Unit (MTU) and HMI, sending legitimate IEC 60870-5-104 commands to the corresponding RTUs. For this purpose, the workstation uses QTester104. In addition, there are three attackers that act as malicious insiders executing the following cyberattacks against the aforementioned RTUs. Finally, the network traffic data of each entity/device was captured through tshark.</p> <p>Table 1: IEC 60870-5-104 Cyberattacks Description</p> <table> <tbody> <tr> <td> <p><strong>IEC 60870-5-104 Cyberattack Description</strong></p> </td> <td> <p><strong>Description</strong></p> </td> <td> <p><strong>Dataset Files</strong></p> </td> </tr> <tr> <td> <p>MITM Drop</p> </td> <td> <p>During this attack, the cyberattacker is placed between two endpoints, thus monitoring and dropping the network traffic exchanged.</p> </td> <td> <p>20200608_UOWM_IEC104_Dataset_mitm_drop.7z</p> </td> </tr> <tr> <td> <p>C_CI_NA_1</p> </td> <td> <p>The C_CI_NA_1 is a Counter Interrogation command in the control direction. This cyberattack sends unauthorised IEC 60870-5-104 C_CI_NA_1 packets to the target system.</p> </td> <td> <p>20200426_UOWM_IEC104_Dataset_c_ci_na_1.7z</p> </td> </tr> <tr> <td> <p>C_SC_NA_1</p> </td> <td> <p>The C_SC_NA_1 command is a single command. This cyberattack sends unauthorised C_SC_NA_1 60870-5-104 packets to the target system</p> </td> <td> <p>20200428_UOWM_IEC104_Dataset_c_sc_na_1.7z</p> </td> </tr> <tr> <td> <p>C_SE_NA_1</p> </td> <td> <p>The C_SE_NA_1 command is a set-point command with normalised values. This cyberattack sends unauthorised IEC 60870-5-104 C_SE_NA_1 packets to the target system.</p> </td> <td> <p>20200427_UOWM_IEC104_Dataset_c_se_na_1.7z</p> </td> </tr> <tr> <td> <p>C_RD_NA_1</p> </td> <td> <p>The C_RD_NA_1 command is a read command. This cyberattack sends unauthorised IEC 60870-5-104 C_RD_NA_1 packets to the target system.</p> </td> <td> <p>20200605_UOWM_IEC104_Dataset_c_rd_na_1.7z</p> </td> </tr> <tr> <td> <p>C_RP_NA_1</p> </td> <td> <p>The C_RP_NA_1 command is a reset command. This cyberattack sends unauthorised IEC 60870-5-104 C_RP_NA_1 packets to the target system.</p> </td> <td> <p>20200606_UOWM_IEC104_Dataset_c_rp_na_1.7z</p> </td> </tr> <tr> <td> <p>M_SP_NA_1_DoS</p> </td> <td> <p>This attack floods the target system with IEC 60870-5-104 M_SP_NA_1 packets.</p> </td> <td> <p>20200425_UOWM_IEC104_Dataset_m_sp_na_1_DoS.7z</p> </td> </tr> <tr> <td> <p>C_CI_NA_1_DoS</p> </td> <td> <p>This attack floods the target system with IEC 60870-5-104 C_CI_NA_1 packets.</p> </td> <td> <p>20200426_UOWM_IEC104_Dataset_c_ci_na_1_DoS.7z</p> </td> </tr> <tr> <td> <p>C_SE_NA_1_DoS</p> </td> <td> <p>This attack floods the target system with IEC 60870-5-104 C_SE_NA_1 packets.</p> </td> <td> <p>20200428_UOWM_IEC104_Dataset_c_se_na_1_DoS.7z</p> </td> </tr> <tr> <td> <p>C_SC_NA_1_DoS</p> </td> <td> <p>This attack floods the target system with IEC 60870-5-104 C_SC_NA_1 packets.</p> </td> <td> <p>20200429_UOWM_IEC104_Dataset_c_sc_na_1_DoS.7z</p> </td> </tr> <tr> <td> <p>C_RD_NA_1_DoS</p> </td> <td> <p>This attack floods the target system with IEC 60870-5-104 C_RD_NA_1 packets.</p> </td> <td> <p>20200605_UOWM_IEC104_Dataset_c_rd_na_1_DoS.7z</p> </td> </tr> <tr> <td> <p>C RP NA 1 DoS</p> </td> <td> <p>This attack floods the target system with IEC 60870-5-104 C_RP_NA_1 packets.</p> </td> <td> <p>20200606_UOWM_IEC104_Dataset_c_rp_na_1_DoS.7z</p> </td> </tr> </tbody> </table> <p>5.Features</p> <p>The TCP/IP network flow statistics generated by CICFlowMeter are summarised below. <strong>It is worth mentioning that the TCP/IP network flows and their statistics generated by </strong><strong>CICFlowMeter are labelled based on the IEC 60870-5-104 attacks described above, thus allowing the training of ML/DL models.</strong></p> <p>Table 2: CICFlowMeter TCP/IP Network Flow Statistics - Features</p> <table> <tbody> <tr> <td> <p><strong>Feature</strong></p> </td> <td> <p><strong>Description</strong></p> </td> </tr> <tr> <td> <p>Flow ID</p> </td> <td> <p>ID of the flow</p> </td> </tr> <tr> <td> <p>Src IP</p> </td> <td> <p>Source IP address</p> </td> </tr> <tr> <td> <p>Src Port</p> </td> <td> <p>Source TCP/UDP port</p> </td> </tr> <tr> <td> <p>Dst IP</p> </td> <td> <p>Destination IP address</p> </td> </tr> <tr> <td> <p>Dst Port</p> </td> <td> <p>Destination TCP/UDP port</p> </td> </tr> <tr> <td> <p>Protocol</p> </td> <td> <p>The protocol related to the corresponding flow</p> </td> </tr> <tr> <td> <p>Timestamp</p> </td> <td> <p>Flow timestamp</p> </td> </tr> <tr> <td> <p>Flow Duration</p> </td> <td> <p>Duration of the flow in Microsecond</p> </td> </tr> <tr> <td> <p>Tot Fwd Pkts</p> </td> <td> <p>Total packets in the forward direction</p> </td> </tr> <tr> <td> <p>Tot Bwd Pkts</p> </td> <td> <p>Total packets in the backward direction</p> </td> </tr> <tr> <td> <p>TotLen Fwd Pkts</p> </td> <td> <p>Total size of packets in forward direction</p> </td> </tr> <tr> <td> <p>TotLen Bwd Pkts</p> </td> <td> <p>Total size of packets in backward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkt Len Max</p> </td> <td> <p>Maximum size of packet in forward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkt Len Min</p> </td> <td> <p>Minimum size of packet in forward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkt Len Mean</p> </td> <td> <p>Mean size of packet in forward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkt Len Std</p> </td> <td> <p>Standard deviation size of packet in forward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkt Len Max</p> </td> <td> <p>Maximum size of packet in backward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkt Len Min</p> </td> <td> <p>Minimum size of packet in backward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkt Len Mean</p> </td> <td> <p>Mean size of packet in backward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkt Len Std</p> </td> <td> <p>Standard deviation size of packet in backward direction</p> </td> </tr> <tr> <td> <p>Flow Byts/s</p> </td> <td> <p>Number of flow bytes per second</p> </td> </tr> <tr> <td> <p>Flow Pkts/s</p> </td> <td> <p>Number of flow packets per second</p> </td> </tr> <tr> <td> <p>Flow IAT Mean</p> </td> <td> <p>Mean time between two packets sent in the flow</p> </td> </tr> <tr> <td> <p>Flow IAT Std</p> </td> <td> <p>Standard deviation time between two packets sent in the flow</p> </td> </tr> <tr> <td> <p>Flow IAT Max</p> </td> <td> <p>Maximum time between two packets sent in the flow</p> </td> </tr> <tr> <td> <p>Flow IAT Min</p> </td> <td> <p>Minimum time between two packets sent in the flow</p> </td> </tr> <tr> <td> <p>Fwd IAT Tot</p> </td> <td> <p>Total time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd IAT Mean</p> </td> <td> <p>Mean time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd IAT Std</p> </td> <td> <p>Standard deviation time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd IAT Max</p> </td> <td> <p>Maximum time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd IAT Min</p> </td> <td> <p>Minimum time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Tot</p> </td> <td> <p>Total time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Mean</p> </td> <td> <p>Mean time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Std</p> </td> <td> <p>Standard deviation time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Max</p> </td> <td> <p>Maximum time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Min</p> </td> <td> <p>Minimum time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Fwd PSH Flags</p> </td> <td> <p>Number of times the PSH flag was set in packets travelling in the forward direction (0 for UDP)</p> </td> </tr> <tr> <td> <p>Bwd PSH Flags</p> </td> <td> <p>Number of times the PSH flag was set in packets travelling in the backward direction (0 for UDP)</p> </td> </tr> <tr> <td> <p>Fwd URG Flags</p> </td> <td> <p>Number of times the URG flag was set in packets travelling in the forward direction (0 for UDP)</p> </td> </tr> <tr> <td> <p>Bwd URG Flags</p> </td> <td> <p>Number of times the URG flag was set in packets travelling in the backward direction (0</p> <p>for UDP)</p> </td> </tr> <tr> <td> <p>Fwd Header Len</p> </td> <td> <p>Total bytes used for headers in the forward direction</p> </td> </tr> <tr> <td> <p>Bwd Header Len</p> </td> <td> <p>Total bytes used for headers in the backward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkts/s</p> </td> <td> <p>Number of forward packets per second</p> </td> </tr> <tr> <td> <p>Bwd Pkts/s</p> </td> <td> <p>Number of backward packets per second</p> </td> </tr> <tr> <td> <p>Pkt Len Min</p> </td> <td> <p>Minimum length of a packet</p> </td> </tr> <tr> <td> <p>Pkt Len Max</p> </td> <td> <p>Maximum length of a packet</p> </td> </tr> <tr> <td> <p>Pkt Len Mean</p> </td> <td> <p>Mean length of a packet</p> </td> </tr> <tr> <td> <p>Pkt Len Std</p> </td> <td> <p>Standard deviation length of a packet</p> </td> </tr> <tr> <td> <p>Pkt Len Var</p> </td> <td> <p>Variance length of a packet</p> </td> </tr> <tr> <td> <p>FIN Flag Cnt</p> </td> <td> <p>Number of packets with FIN</p> </td> </tr> <tr> <td> <p>SYN Flag Cnt</p> </td> <td> <p>Number of packets with SYN</p> </td> </tr> <tr> <td> <p>RST Flag Cnt</p> </td> <td> <p>Number of packets with RST</p> </td> </tr> <tr> <td> <p>PSH Flag Cnt</p> </td> <td> <p>Number of packets with PUSH</p> </td> </tr> <tr> <td> <p>ACK Flag Cnt</p> </td> <td> <p>Number of packets with ACK</p> </td> </tr> <tr> <td> <p>URG Flag Cnt</p> </td> <td> <p>Number of packets with URG</p> </td> </tr> <tr> <td> <p>CWE Flag Count</p> </td> <td> <p>Number of packets with CWE</p> </td> </tr> <tr> <td> <p>ECE Flag Cnt</p> </td> <td> <p>Number of packets with ECE</p> </td> </tr> <tr> <td> <p>Down/Up Ratio</p> </td> <td> <p>Download and upload ratio</p> </td> </tr> <tr> <td> <p>Pkt Size Avg</p> </td> <td> <p>Average size of packet</p> </td> </tr> <tr> <td> <p>Fwd Seg Size Avg</p> </td> <td> <p>Average size observed in the forward direction</p> </td> </tr> <tr> <td> <p>Bwd Seg Size Avg</p> </td> <td> <p>Average size observed in the backward direction</p> </td> </tr> <tr> <td> <p>Fwd Byts/b Avg</p> </td> <td> <p>Average number of bytes bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkts/b Avg</p> </td> <td> <p>Average number of packets bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd Blk Rate Avg</p> </td> <td> <p>Average number of bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>Bwd Byts/b Avg</p> </td> <td> <p>Average number of bytes bulk rate in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkts/b Avg</p> </td> <td> <p>Average number of packets bulk rate in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd Blk Rate Avg</p> </td> <td> <p>Average number of bulk rate in the backward direction</p> </td> </tr> <tr> <td> <p>Subflow Fwd Pkts</p> </td> <td> <p>The average number of packets in a sub flow in the forward direction</p> </td> </tr> <tr> <td> <p>Subflow Fwd Byts</p> </td> <td> <p>The average number of bytes in a sub flow in the forward direction</p> </td> </tr> <tr> <td> <p>Subflow Bwd Pkts</p> </td> <td> <p>The average number of packets in a sub flow in the backward direction</p> </td> </tr> <tr> <td> <p>Subflow Bwd Byts</p> </td> <td> <p>The average number of bytes in a sub flow in the backward direction</p> </td> </tr> <tr> <td> <p>Init Fwd Win Byts</p> </td> <td> <p>The total number of bytes sent in initial window in the forward direction</p> </td> </tr> <tr> <td> <p>Init Bwd Win Byts</p> </td> <td> <p>The total number of bytes sent in initial window in the backward direction</p> </td> </tr> <tr> <td> <p>Fwd Act Data Pkts</p> </td> <td> <p>Count of packets with at least 1 byte of TCP data payload in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd Seg Size Min</p> </td> <td> <p>Minimum segment size observed in the forward direction</p> </td> </tr> <tr> <td> <p>Active Mean</p> </td> <td> <p>Mean time a flow was active before becoming idle</p> </td> </tr> <tr> <td> <p>Active Std</p> </td> <td> <p>Standard deviation time a flow was active before becoming idle</p> </td> </tr> <tr> <td> <p>Active Max</p> </td> <td> <p>Maximum time a flow was active before becoming idle</p> </td> </tr> <tr> <td> <p>Active Min</p> </td> <td> <p>Minimum time a flow was active before becoming idle</p> </td> </tr> <tr> <td> <p>Idle Mean</p> </td> <td> <p>Mean time a flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>Idle Std</p> </td> <td> <p>Standard deviation time a flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>Idle Max</p> </td> <td> <p>Maximum time a flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>Idle Min</p> </td> <td> <p>Minimum time a flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>Label</p> </td> <td> <p>Attack label</p> </td> </tr> </tbody> </table> <p>The IEC 60870-5-104 flow statistics generated by IEC 60870-5-104 Python Parser are summarised below. <strong>It is worth mentioning that the IEC 60870-5-104 flows and their statistics generated by </strong><strong>IEC 60870-5-104 Python Parser are labelled based on the IEC 60870-5-104 attacks described above, thus allowing the training of ML/DL models.</strong></p> <p>Table 3: IEC 60870-5-104 Flow Statistics – Features</p> <table> <tbody> <tr> <td> <p><strong>Feature</strong></p> </td> <td> <p><strong>Field description</strong></p> </td> </tr> <tr> <td> <p>flow id</p> </td> <td> <p>ID of the flow</p> </td> </tr> <tr> <td> <p>protocol</p> </td> <td> <p>The relevant protocol of the flow. It equals IEC 60870-5-104</p> </td> </tr> <tr> <td> <p>src ip</p> </td> <td> <p>The source IP address of the flow. It is defined with the first relevant packet.</p> </td> </tr> <tr> <td> <p>dst ip</p> </td> <td> <p>The destination IP address of the flow.</p> </td> </tr> <tr> <td> <p>src port</p> </td> <td> <p>The source TCP/UDP port.</p> </td> </tr> <tr> <td> <p>dst port</p> </td> <td> <p>The destination TCP/UDP port.</p> </td> </tr> <tr> <td> <p>flow idle time max</p> </td> <td> <p>The maximum time where the flow was idle</p> </td> </tr> <tr> <td> <p>flow idle time min</p> </td> <td> <p>The minimum time where the flow was idle</p> </td> </tr> <tr> <td> <p>flow idle time mean</p> </td> <td> <p>The time mean where the flow was idle</p> </td> </tr> <tr> <td> <p>flow idle time std</p> </td> <td> <p>The time standard deviation where the flow was idle</p> </td> </tr> <tr> <td> <p>flow idle time variance</p> </td> <td> <p>The time variance where the flow was idle</p> </td> </tr> <tr> <td> <p>flow active time max</p> </td> <td> <p>The maximum time where the flow was active</p> </td> </tr> <tr> <td> <p>flow active time min</p> </td> <td> <p>The minimum time where the flow was active</p> </td> </tr> <tr> <td> <p>flow active time mean</p> </td> <td> <p>The time mean where the flow was active</p> </td> </tr> <tr> <td> <p>flow active time std</p> </td> <td> <p>The time standard deviation where the flow was active</p> </td> </tr> <tr> <td> <p>flow active time variance</p> </td> <td> <p>The time variance where the flow was active</p> </td> </tr> <tr> <td> <p>flow IAT max</p> </td> <td> <p>The maximum interarrival time</p> </td> </tr> <tr> <td> <p>fw IAT max</p> </td> <td> <p>The maximum interarrival time in the forward direction</p> </td> </tr> <tr> <td> <p>bw IAT max</p> </td> <td> <p>The maximum interarrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>flow IAT min</p> </td> <td> <p>The minimum interarrival time</p> </td> </tr> <tr> <td> <p>fw IAT min</p> </td> <td> <p>The minimum interarrival time in the forward direction</p> </td> </tr> <tr> <td> <p>bw IAT min</p> </td> <td> <p>The minimum interarrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>flow IAT mean</p> </td> <td> <p>The mean of the interarrival time</p> </td> </tr> <tr> <td> <p>fw IAT mean</p> </td> <td> <p>The mean of the interarrival time in the forward direction</p> </td> </tr> <tr> <td> <p>bw IAT mean</p> </td> <td> <p>The mean of the interarrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>flow IAT std</p> </td> <td> <p>The standard deviation of the inter arrival time</p> </td> </tr> <tr> <td> <p>fw IAT std</p> </td> <td> <p>The standard deviation of the inter arrival time in the forward direction</p> </td> </tr> <tr> <td> <p>bw IAT std</p> </td> <td> <p>The standard deviation of the inter arrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>flow IAT tot</p> </td> <td> <p>The total number of the interarrival times</p> </td> </tr> <tr> <td> <p>fw iAT tot</p> </td> <td> <p>The total number of the interarrival times in the forward direction</p> </td> </tr> <tr> <td> <p>bw IAT tot</p> </td> <td> <p>The total number of the interarrival times in the backyard direction</p> </td> </tr> <tr> <td> <p>flow iec104 packts/s</p> </td> <td> <p>The number of IEC 60870-51-04 packets per second</p> </td> </tr> <tr> <td> <p>fw iec104 packts/s</p> </td> <td> <p>The number of IEC 60870-51-04 packets per second in the forward direction</p> </td> </tr> <tr> <td> <p>bw iec104 packts/s</p> </td> <td> <p>The number of IEC 60870-51-04 packets per second in the backyard direction</p> </td> </tr> <tr> <td> <p>flow iec104 bytes/s</p> </td> <td> <p>The sum of APDU lengths per second</p> </td> </tr> <tr> <td> <p>fw iec104 bytes/s</p> </td> <td> <p>The sum of APDU lengths per second in the forward direction</p> </td> </tr> <tr> <td> <p>bw iec104 bytes/s</p> </td> <td> <p>The sum of APDU lengths per second in the backyard direction</p> </td> </tr> <tr> <td> <p>flow packet APDU length max</p> </td> <td> <p>The maximum value of the APDU lengths</p> </td> </tr> <tr> <td> <p>flow packet APDU length min</p> </td> <td> <p>The minimum value of the APDU lengths</p> </td> </tr> <tr> <td> <p>flow packet APDU length mean</p> </td> <td> <p>Mean of the APDU lengths</p> </td> </tr> <tr> <td> <p>flow packet APDU length std</p> </td> <td> <p>The standard deviation of the APDU lengths</p> </td> </tr> <tr> <td> <p>flow packet APDU length var</p> </td> <td> <p>Variance of the APDU lengths</p> </td> </tr> <tr> <td> <p>fw packet APDU length max</p> </td> <td> <p>The maximum value of the APDU lengths in the forward direction</p> </td> </tr> <tr> <td> <p>fw packet APDU length min</p> </td> <td> <p>The minimum value of the APDU lengths in the forward direction</p> </td> </tr> <tr> <td> <p>fw packet APDU length mean</p> </td> <td> <p>Mean of the APDU lengths in the forward direction</p> </td> </tr> <tr> <td> <p>fw packet APDU length std</p> </td> <td> <p>The standard deviation of the APDU lengths in the forward direction</p> </td> </tr> <tr> <td> <p>fw packet APDU length var</p> </td> <td> <p>The variance of the APDU lengths in the forward direction</p> </td> </tr> <tr> <td> <p>bw packet APDU length max</p> </td> <td> <p>The maximum value of the APDU lengths in the backyard direction</p> </td> </tr> <tr> <td> <p>bw packet APDU length min</p> </td> <td> <p>The minimum value of the APDU lengths in the backyard direction</p> </td> </tr> <tr> <td> <p>bw packet APDU length mean</p> </td> <td> <p>Mean of the APDU lengths in the backyard direction</p> </td> </tr> <tr> <td> <p>bw packet APDU length std</p> </td> <td> <p>The standard deviation of the APDU lengths in the backyard direction</p> </td> </tr> <tr> <td> <p>bw packet APDU length var</p> </td> <td> <p>The variance of the APDU lengths in the backyard direction</p> </td> </tr> <tr> <td> <p>total flow packets</p> </td> <td> <p>Total flow packets</p> </td> </tr> <tr> <td> <p>total fw packets</p> </td> <td> <p>Total flow packets in the forward direction</p> </td> </tr> <tr> <td> <p>total bw packets</p> </td> <td> <p>Total flow packets in the backyard direction</p> </td> </tr> <tr> <td> <p>flow packets APDU total length</p> </td> <td> <p>The sum of all APDU lengths</p> </td> </tr> <tr> <td> <p>fw packets APDU total length</p> </td> <td> <p>The sum of all APDU lengths in the forward direction</p> </td> </tr> <tr> <td> <p>bw packets APDU total length</p> </td> <td> <p>The sum of all APDU lengths in the backyard direction</p> </td> </tr> <tr> <td> <p>flow duration</p> </td> <td> <p>Flow duration in seconds</p> </td> </tr> <tr> <td> <p>flow down/up ratio</p> </td> <td> <p>The fraction between the IEC 60870-5-104 packets in the backyard direction and the IEC 60870-5-104 packets in the forward direction</p> </td> </tr> <tr> <td> <p>flow total IEC104_I_Message_SeqIOA packets</p> </td> <td> <p>The total number of the I-format APCI packets that have more than one information objects</p> </td> </tr> <tr> <td> <p>fw total IEC104_I_Message_SeqIOA packets</p> </td> <td> <p>The total number of the I-format APCI packets that have more than one information objects in the forward direction</p> </td> </tr> <tr> <td> <p>bw total IEC104_I_Message_SeqIOA packets</p> </td> <td> <p>The total number of the I-format APCI packets that have more than one information objects in the backyard direction</p> </td> </tr> <tr> <td> <p>flow total IEC104_I_Message_SingleIOA packets</p> </td> <td> <p>The total number of the I-format APCI packets that have one information object in ASDU</p> </td> </tr> <tr> <td> <p>fw total IEC104_I_Message_SingleIOA packets</p> </td> <td> <p>The total number of the I-format APCI packets that have one information object in ASDU in the forward direction</p> </td> </tr> <tr> <td> <p>bw total IEC104_I_Message_SingleIOA packets</p> </td> <td> <p>The total number of the I-format APCI packets that have one information object in ASDU in the backyard direction</p> </td> </tr> <tr> <td> <p>flow total IEC104_S_Message packets</p> </td> <td> <p>The total number of the S-format APCI packets</p> </td> </tr> <tr> <td> <p>fw total IEC104_S_Message packets</p> </td> <td> <p>The total number of the S-format APCI packets in the forward direction</p> </td> </tr> <tr> <td> <p>bw total IEC104_S_Message packets</p> </td> <td> <p>The total number of the S-format APCI packets in the backyard direction</p> </td> </tr> <tr> <td> <p>flow total IEC104_U_Message packets</p> </td> <td> <p>The total number of the U-format APCI packets</p> </td> </tr> <tr> <td> <p>fw total IEC104_U_Message packets</p> </td> <td> <p>The total number of the U-format APCI packets in the forward direction</p> </td> </tr> <tr> <td> <p>bw total IEC104_U_Message packets</p> </td> <td> <p>The total number of the U-format APCI packets in the backyard direction</p> </td> </tr> <tr> <td> <p>fw URG flag amount</p> </td> <td> <p>The number of the URG flags in the forward direction</p> </td> </tr> <tr> <td> <p>fw PSH flag amount</p> </td> <td> <p>The number of the PSH flags in the forward direction</p> </td> </tr> <tr> <td> <p>bw URG flag amount</p> </td> <td> <p>The number of the URG flags in the backyard direction</p> </td> </tr> <tr> <td> <p>bw PSH flag amount</p> </td> <td> <p>The number of the PSH flags in the backyard direction</p> </td> </tr> <tr> <td> <p>flow SYN flag count</p> </td> <td> <p>The number of the TCP SYN packets</p> </td> </tr> <tr> <td> <p>flow RST flag count</p> </td> <td> <p>The number of the TCP RST packets</p> </td> </tr> <tr> <td> <p>flow PSH flag count</p> </td> <td> <p>The number of the TCP PSH packets</p> </td> </tr> <tr> <td> <p>flow ACK flag count</p> </td> <td> <p>The number of the TCP ACK packets</p> </td> </tr> <tr> <td> <p>flow URG flag count</p> </td> <td> <p>The number of the TCP URG packets</p> </td> </tr> <tr> <td> <p>flow CWE flag count</p> </td> <td> <p>The number of the TCP CWE packets</p> </td> </tr> <tr> <td> <p>flow ECE flag count</p> </td> <td> <p>The number of the TCP ECE packets</p> </td> </tr> <tr> <td> <p>fw_subflow_packets</p> </td> <td> <p>The average number of packets in a sub flow in the forward direction</p> </td> </tr> <tr> <td> <p>bw_subflow_packets</p> </td> <td> <p>The average number of packets in a sub flow in the backward direction</p> </td> </tr> <tr> <td> <p>fw_subflow_bytes</p> </td> <td> <p>The average number of bytes in a sub flow in the forward direction</p> </td> </tr> <tr> <td> <p>bw_subflow_bytes</p> </td> <td> <p>The average number of bytes in a sub flow in the backward direction</p> </td> </tr> <tr> <td> <p>flow start timestamp</p> </td> <td> <p>The timestamp of the flow. It is defined with the first relevant packet.</p> </td> </tr> <tr> <td> <p>fw avg bytes/bulk</p> </td> <td> <p>Average number of bytes bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>bw avg bytes/bulk</p> </td> <td> <p>Average number of bytes bulk rate in the backyard direction</p> </td> </tr> <tr> <td> <p>fw avg bulk rate</p> </td> <td> <p>Average number of bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>bw avg bulk rate</p> </td> <td> <p>Average number of bulk rate in the backyard direction</p> </td> </tr> <tr> <td> <p>fw avg packets/bulk</p> </td> <td> <p>Average number of packets bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>bw avg packets/bulk</p> </td> <td> <p>Average number of packets bulk rate in the backyard direction</p> </td> </tr> <tr> <td> <p>init fw window bytes</p> </td> <td> <p>The window size of the first packet in the forward direction</p> </td> </tr> <tr> <td> <p>init bw window bytes</p> </td> <td> <p>The window size of the first packet in the backyard direction</p> </td> </tr> <tr> <td> <p>fw TCP total header length</p> </td> <td> <p>The length of the TCP headers in the forward direction</p> </td> </tr> <tr> <td> <p>bw TCP total header length</p> </td> <td> <p>The length of the TCP headers in the backyard direction</p> </td> </tr> <tr> <td> <p>cot=1</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 1 (periodic,cyclic)</p> </td> </tr> <tr> <td> <p>cot=2</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 2 (background interrogation)</p> </td> </tr> <tr> <td> <p>cot=3</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 3 (spontaneous)</p> </td> </tr> <tr> <td> <p>cot=4</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 4 (initialized)</p> </td> </tr> <tr> <td> <p>cot=5</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 5 (interrogation)</p> </td> </tr> <tr> <td> <p>cot=6</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 6 (activation)</p> </td> </tr> <tr> <td> <p>cot=7</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 7 (confirmation activation)</p> </td> </tr> <tr> <td> <p>cot=8</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 8 (deactivation)</p> </td> </tr> <tr> <td> <p>cot=9</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 9 (confirmation deactivation)</p> </td> </tr> <tr> <td> <p>cot=10</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 10 (termination activation)</p> </td> </tr> <tr> <td> <p>cot=11</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 11 (feedback, caused by distant command)</p> </td> </tr> <tr> <td> <p>cot=12</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 12 (feedback, caused by local command)</p> </td> </tr> <tr> <td> <p>cot=13</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 13 (COT data transmission)</p> </td> </tr> <tr> <td> <p>cot=20</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where COT = 20 (interrogated by general interrogation)</p> </td> </tr> <tr> <td> <p>type_id_process_information_in_monitor_direction</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where TypeID is in the range 1-40</p> </td> </tr> <tr> <td> <p>type_id_process_information_in_control_direction</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where TypeID is in the range 45-51</p> </td> </tr> <tr> <td> <p>type_id_system_information_in_monitor_direction</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where TypeID is in the range 70</p> </td> </tr> <tr> <td> <p>type_id_system_information_in_control_direction</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where TypeID is in the range 100-106</p> </td> </tr> <tr> <td> <p>type_id_parameter_in_control_direction</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where TypeID is in the range 110-113</p> </td> </tr> <tr> <td> <p>type_id_file_transfer</p> </td> <td> <p>The total number of the IEC 60870-5-104 packets where TypeID is in the range 120-126</p> </td> </tr> <tr> <td> <p>Label</p> </td> <td> <p>Attack label</p> </td> </tr> </tbody> </table> <p>6.Citation</p> <p>Please cite the following paper when using this dataset:</p> <p><em>P. Radoglou-Grammatikis, K. Rompolos, P. Sarigiannidis, V. Argyriou, T. Lagkas, A. Sarigiannidis, S. Goudos and S. Wan, "Modeling, Detecting, and Mitigating Threats Against Industrial Healthcare Systems: A Combined Software Defined Networking and Reinforcement Learning Approach", in IEEE Transactions on Industrial Informatics, vol. 18, no. 3, pp. 2041-2052, March 2022, doi: 10.1109/TII.2021.3093905.</em></p> <p><a href="https://ieeexplore.ieee.org/document/9470933"><em>https://ieeexplore.ieee.org/document/9470933</em></a></p> <p>7.Acknowledgment</p> <p>This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreements No 101021936 (ELECTRON) and No 833955 (SDN-microSENSE).</p> <p>References</p> <ol> <li>P. Radoglou-Grammatikis, K. Rompolos, P. Sarigiannidis, V. Argyriou, T. Lagkas, A. Sarigiannidis, S. Goudos and S. Wan, "Modeling, Detecting, and Mitigating Threats Against Industrial Healthcare Systems: A Combined Software Defined Networking and Reinforcement Learning Approach", in IEEE Transactions on Industrial Informatics, vol. 18, no. 3, pp. 2041-2052, March 2022, doi: 10.1109/TII.2021.3093905.</li> <li>A. Gharib, I. Sharafaldin, A. H. Lashkari and A. A. Ghorbani, "An Evaluation Framework for Intrusion Detection Dataset," 2016 International Conference on Information Science and Security (ICISS), 2016, pp. 1-6, doi: 10.1109/ICISSEC.2016.7885840.</li> </ol> <p> </p> <p><a href="#_ftnref1">[1]</a> IEC TestServer - https://sourceforge.net/projects/iecserver/</p> <p><a href="#_ftnref2">[2]</a> QTester104 - https://sourceforge.net/projects/qtester104/</p> <p><a href="#_ftnref3">[3]</a> Kali Linux - https://www.kali.org/</p> <p><a href="#_ftnref4">[4]</a> Metasploit - https://www.metasploit.com/</p> <p><a href="#_ftnref5">[5]</a> OpenMUC j60870 - https://www.openmuc.org/iec-60870-5-104/</p> <p><a href="#_ftnref6">[6]</a> Ettercap - https://www.ettercap-project.org/</p> <p><a href="#_ftnref7">[7]</a> CICFlowMeter - https://github.com/ahlashkari/CICFlowMeter</p> <p><a href="#_ftnref8">[8]</a> This parser is provided after a communication with the authors.</p> <p><a href="#_ftnref9">[9]</a> Scapy - https://scapy.net/</p>
DNP3 Intrusion Detection Dataset
<p>1.Introduction</p> <p>In the digital era of the Industrial Internet of Things (IIoT), the conventional Critical Infrastructures (CIs) are transformed into smart environments with multiple benefits, such as pervasive control, self-monitoring and self-healing. However, this evolution is characterised by several cyberthreats due to the necessary presence of insecure technologies. DNP3 is an industrial communication protocol which is widely adopted in the CIs of the US. In particular, DNP3 allows the remote communication between Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA). It can support various topologies, such as Master-Slave, Multi-Drop, Hierarchical and Multiple-Server. Initially, the architectural model of DNP3 consists of three layers: (a) Application Layer, (b) Transport Layer and (c) Data Link Layer. However, DNP3 can be now incorporated into the Transmission Control Protocol/Internet Protocol (TCP/IP) stack as an application-layer protocol. However, similarly to other industrial protocols (e.g., Modbus and IEC 60870-5-104), DNP3 is characterised by severe security issues since it does not include any authentication or authorisation mechanisms. More information about the DNP3 security issue is provided in [1-3]. This dataset contains labelled Transmission Control Protocol (TCP) / Internet Protocol (IP) network flow statistics (Common-Separated Values - CSV format) and DNP3 flow statistics (CSV format) related to 9 DNP3 cyberattacks. These cyberattacks are focused on DNP3 unauthorised commands and Denial of Service (DoS). The network traffic data are provided through Packet Capture (PCAP) files. Consequently, this dataset can be used to implement Artificial Intelligence (AI)-powered Intrusion Detection and Prevention (IDPS) systems that rely on Machine Learning (ML) and Deep Learning (DL) techniques.</p> <p>2.Instructions</p> <p>This DNP3 Intrusion Detection Dataset was implemented following the methodological frameworks of A. Gharib et al. in [4] and S. Dadkhah et al in [5], including eleven features: (a) Complete Network Configuration, (b) Complete Traffic, (c) Labelled Dataset, (d) Complete Interaction, (e) Complete Capture, (f) Available Protocols, (g) Attack Diversity, (h) Heterogeneity, (i) Feature Set and (j) Metadata.</p> <p>A network topology consisting of (a) eight industrial entities, (b) one Human Machine Interfaces (HMI) and (c) three cyberattackers was used to implement this DNP3 Intrusion Detection Dataset. In particular, the following cyberattacks were implemented.</p> <ul> <li>On Thursday, May 14, 2020, the <strong>DNP3 Disable Unsolicited Messages Attack</strong> was executed for 4 hours.</li> <li>On Friday, May 15, 2020, the <strong>DNP3 Cold Restart Message Attack</strong> was executed for 4 hours.</li> <li>On Friday, May 15, 2020, the <strong>DNP3 Warm Restart Message Attack</strong> was executed for 4 hours.</li> <li>On Saturday, May 16, 2020, the <strong>DNP3 Enumerate Attack</strong> was executed for 4 hours.</li> <li>On Saturday, May 16, 2020, the <strong>DNP3 Info Attack</strong> was executed for 4 hours.</li> <li>On Monday, May 18, 2020, the <strong>DNP3 Initialisation Attack</strong> was executed for 4 hours.</li> <li>On Monday, May 18, 2020, the <strong>Man In The Middle (MITM)-DoS Attack</strong> was executed for 4 hours.</li> <li>On Monday, May 18, 2020, the <strong>DNP3</strong> <strong>Replay Attack</strong> was executed for 4 hours.</li> <li>On Tuesday, May 19, 2020, the <strong>DNP3 Stop Application Attack</strong> was executed for 4 hours.</li> </ul> <p>The aforementioned DNP3 cyberattacks were executed, utilising penetration testing tools, such as Nmap and Scapy. For each attack, a relevant folder is provided, including the network traffic and the network flow statistics for each entity. In particular, for each cyberattack, a folder is given, providing (a) the pcap files for each entity, (b) the Transmission Control Protocol (TCP)/ Internet Protocol (IP) network flow statistics for 120 seconds in a CSV format and (c) the DNP3 flow statistics for each entity (using different timeout values in terms of second (such as 45, 60, 75, 90, 120 and 240 seconds)). The TCP/IP network flow statistics were produced by using the CICFlowMeter, while the DNP3 flow statistics were generated based on a Custom DNP3 Python Parser, taking full advantage of Scapy.</p> <p>3. Dataset Structure</p> <p>The dataset consists of the following folders:</p> <ul> <li><strong>20200514_DNP3_Disable_Unsolicited_Messages_Attack</strong>: It includes the pcap and CSV files related to the DNP3 Disable Unsolicited Message attack.</li> <li><strong>20200515_DNP3_Cold_Restart_Attack</strong>: It includes the pcap and CSV files related to the DNP3 Cold Restart attack.</li> <li><strong>20200515_DNP3_Warm_Restart_Attack</strong>: It includes the pcap and CSV files related to DNP3 Warm Restart attack.</li> <li><strong>20200516_DNP3_Enumerate</strong>: It includes the pcap and CSV files related to the DNP3 Enumerate attack.</li> <li><strong>20200516_DNP3_Ιnfo</strong>: It includes the pcap and CSV files related to the DNP3 Info attack.</li> <li><strong>20200518_DNP3_Initialize_Data_Attack</strong>: It includes the pcap and CSV files related to the DNP3 Data Initialisation attack.</li> <li><strong>20200518_DNP3_MITM_DoS</strong>: It includes the pcap and CSV files related to the DNP3 MITM-DoS attack.</li> <li><strong>20200518_DNP3_Replay_Attack</strong>: It includes the pcap and CSV files related to the DNP3 replay attack.</li> <li><strong>20200519_DNP3_Stop_Application_Attack</strong>: It includes the pcap and CSV files related to the DNP3 Stop Application attack.</li> <li><strong>Training_Testing_Balanced_CSV_Files</strong>: It includes balanced CSV files from CICFlowMeter and the Custom DNP3 Python Parser that could be utilised for training ML and DL methods. Each folder includes different sub-folder for the corresponding flow timeout values used by the DNP3 Python Custom Parser. For CICFlowMeter, only the timeout value of 120 seconds was used.</li> </ul> <p>Each folder includes respective subfolders related to the entities/devices (described in the following section) participating in each attack. In particular, for each entity/device, there is a folder including (a) the DNP3 network traffic (pcap file) related to this entity/device during each attack, (b) the TCP/IP network flow statistics (CSV file) generated by CICFlowMeter for the timeout value of 120 seconds and finally (c) the DNP3 flow statistics (CSV file) from the Custom DNP3 Python Parser. Finally, it is noteworthy that the network flows from both CICFlowMeter and Custom DNP3 Python Parser in each CSV file are <strong>labelled</strong> based on the DNP3 cyberattacks executed for the generation of this dataset. The description of these attacks is provided in the following section, while the various features from CICFlowMeter and Custom DNP3 Python Parser are presented in Section 5.</p> <p>4.Testbed & DNP3 Attacks</p> <p>The following figure shows the testbed utilised for the generation of this dataset. It is composed of eight industrial entities that play the role of the DNP3 outstations/slaves, such as Remote Terminal Units (RTUs) and Intelligent Electron Devices (IEDs). Moreover, there is another workstation which plays the role of the Master station like a Master Terminal Unit (MTU). For the communication between, the DNP3 outstations/slaves and the master station, opendnp3 was used.</p> <p> </p> <p>Table 1: DNP3 Attacks Description</p> <table> <tbody> <tr> <td> <p><strong>DNP3 Attack </strong></p> </td> <td> <p><strong>Description</strong></p> </td> <td> <p><strong>Dataset Folder</strong></p> </td> </tr> <tr> <td> <p>DNP3 Disable Unsolicited Message Attack</p> </td> <td> <p>This attack targets a DNP3 outstation/slave, establishing a connection with it, while acting as a master station. The false master then transmits a packet with the DNP3 Function Code 21, which requests to disable all the unsolicited messages on the target.</p> </td> <td> <p>20200514_DNP3_Disable_Unsolicited_Messages_Attack</p> </td> </tr> <tr> <td> <p>DNP3 Cold Restart Attack</p> </td> <td> <p>The malicious entity acts as a master station and sends a DNP3 packet that includes the “Cold Restart” function code. When the target receives this message, it initiates a complete restart and sends back a reply with the time window before the restart process.</p> </td> <td> <p>20200515_DNP3_Cold_Restart_Attack</p> </td> </tr> <tr> <td> <p>DNP3 Warm Restart Attack</p> </td> <td> <p>This attack is quite similar to the “Cold Restart Message”, but aims to trigger a partial restart, re-initiating a DNP3 service on the target outstation.</p> </td> <td> <p>20200515_DNP3_Warm_Restart_Attack</p> </td> </tr> <tr> <td> <p>DNP3 Enumerate Attack</p> </td> <td> <p>This reconnaissance attack aims to discover which DNP3 services and functional codes are used by the target system.</p> </td> <td> <p>20200516_DNP3_Enumerate</p> </td> </tr> <tr> <td> <p>DNP3 Info Attack</p> </td> <td> <p>This attack constitutes another reconnaissance attempt, aggregating various DNP3 diagnostic information related the DNP3 usage.</p> </td> <td> <p>20200516_DNP3_Ιnfo</p> </td> </tr> <tr> <td> <p>Data Initialisation Attack</p> </td> <td> <p>This cyberattack is related to Function Code 15 (Initialize Data). It is an unauthorised access attack, which demands from the slave to re-initialise possible configurations to their initial values, thus changing potential values defined by legitimate masters</p> </td> <td> <p>20200518_Initialize_Data_Attack</p> </td> </tr> <tr> <td> <p>MITM-DoS Attack</p> </td> <td> <p>In this cyberattack, the cyberattacker is placed between a DNP3 master and a DNP3 slave device, dropping all the messages coming from the DNP3 master or the DNP3 slave.</p> </td> <td> <p>20200518_MITM_DoS</p> </td> </tr> <tr> <td> <p>DNP3 Replay Attack</p> </td> <td> <p>This cyberattack replays DNP3 packets coming from a legitimate DNP3 master or DNP3 slave.</p> </td> <td> <p>20200518_DNP3_Replay_Attack</p> </td> </tr> <tr> <td> <p>DNP3 Step Application Attack</p> </td> <td> <p>This attack is related to the Function Code 18 (Stop Application) and demands from the slave to stop its function so that the slave cannot receive messages from the master.</p> </td> <td> <p>20200519_DNP3_Stop_Application_Attack</p> </td> </tr> </tbody> </table> <p> </p> <p>5. Features</p> <p>The TCP/IP network flow statistics generated by CICFlowMeter are summarised below. <strong>T</strong><strong>he TCP/IP network flows and their statistics generated by </strong><strong>CICFlowMeter are labelled based on the DNP3 attacks described above, thus allowing the training of ML/DL models. Finally, it is worth mentioning that these statistics are generated when the flow timeout value is equal with 120 seconds.</strong></p> <p>Table 2: CICFlowMeter TCP/IP Network Flow Statistics - Features</p> <table> <tbody> <tr> <td> <p><strong>Feature</strong></p> </td> <td> <p><strong>Description</strong></p> </td> </tr> <tr> <td> <p>Flow ID</p> </td> <td> <p>ID of the flow</p> </td> </tr> <tr> <td> <p>Src IP</p> </td> <td> <p>Source IP address</p> </td> </tr> <tr> <td> <p>Src Port</p> </td> <td> <p>Source TCP/UDP port</p> </td> </tr> <tr> <td> <p>Dst IP</p> </td> <td> <p>Destination IP address</p> </td> </tr> <tr> <td> <p>Dst Port</p> </td> <td> <p>Destination TCP/UDP port</p> </td> </tr> <tr> <td> <p>Protocol</p> </td> <td> <p>The protocol related to the corresponding flow</p> </td> </tr> <tr> <td> <p>Timestamp</p> </td> <td> <p>Flow timestamp</p> </td> </tr> <tr> <td> <p>Flow Duration</p> </td> <td> <p>Duration of the flow in Microsecond</p> </td> </tr> <tr> <td> <p>Tot Fwd Pkts</p> </td> <td> <p>Total packets in the forward direction</p> </td> </tr> <tr> <td> <p>Tot Bwd Pkts</p> </td> <td> <p>Total packets in the backward direction</p> </td> </tr> <tr> <td> <p>TotLen Fwd Pkts</p> </td> <td> <p>Total size of packets in forward direction</p> </td> </tr> <tr> <td> <p>TotLen Bwd Pkts</p> </td> <td> <p>Total size of packets in backward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkt Len Max</p> </td> <td> <p>Maximum size of packet in forward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkt Len Min</p> </td> <td> <p>Minimum size of packet in forward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkt Len Mean</p> </td> <td> <p>Mean size of packet in forward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkt Len Std</p> </td> <td> <p>Standard deviation size of packet in forward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkt Len Max</p> </td> <td> <p>Maximum size of packet in backward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkt Len Min</p> </td> <td> <p>Minimum size of packet in backward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkt Len Mean</p> </td> <td> <p>Mean size of packet in backward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkt Len Std</p> </td> <td> <p>Standard deviation size of packet in backward direction</p> </td> </tr> <tr> <td> <p>Flow Byts/s</p> </td> <td> <p>Number of flow bytes per second</p> </td> </tr> <tr> <td> <p>Flow Pkts/s</p> </td> <td> <p>Number of flow packets per second</p> </td> </tr> <tr> <td> <p>Flow IAT Mean</p> </td> <td> <p>Mean time between two packets sent in the flow</p> </td> </tr> <tr> <td> <p>Flow IAT Std</p> </td> <td> <p>Standard deviation time between two packets sent in the flow</p> </td> </tr> <tr> <td> <p>Flow IAT Max</p> </td> <td> <p>Maximum time between two packets sent in the flow</p> </td> </tr> <tr> <td> <p>Flow IAT Min</p> </td> <td> <p>Minimum time between two packets sent in the flow</p> </td> </tr> <tr> <td> <p>Fwd IAT Tot</p> </td> <td> <p>Total time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd IAT Mean</p> </td> <td> <p>Mean time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd IAT Std</p> </td> <td> <p>Standard deviation time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd IAT Max</p> </td> <td> <p>Maximum time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd IAT Min</p> </td> <td> <p>Minimum time between two packets sent in the forward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Tot</p> </td> <td> <p>Total time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Mean</p> </td> <td> <p>Mean time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Std</p> </td> <td> <p>Standard deviation time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Max</p> </td> <td> <p>Maximum time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd IAT Min</p> </td> <td> <p>Minimum time between two packets sent in the backward direction</p> </td> </tr> <tr> <td> <p>Fwd PSH Flags</p> </td> <td> <p>Number of times the PSH flag was set in packets travelling in the forward direction (0 for UDP)</p> </td> </tr> <tr> <td> <p>Bwd PSH Flags</p> </td> <td> <p>Number of times the PSH flag was set in packets travelling in the backward direction (0 for UDP)</p> </td> </tr> <tr> <td> <p>Fwd URG Flags</p> </td> <td> <p>Number of times the URG flag was set in packets travelling in the forward direction (0 for UDP)</p> </td> </tr> <tr> <td> <p>Bwd URG Flags</p> </td> <td> <p>Number of times the URG flag was set in packets travelling in the backward direction (0</p> <p>for UDP)</p> </td> </tr> <tr> <td> <p>Fwd Header Len</p> </td> <td> <p>Total bytes used for headers in the forward direction</p> </td> </tr> <tr> <td> <p>Bwd Header Len</p> </td> <td> <p>Total bytes used for headers in the backward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkts/s</p> </td> <td> <p>Number of forward packets per second</p> </td> </tr> <tr> <td> <p>Bwd Pkts/s</p> </td> <td> <p>Number of backward packets per second</p> </td> </tr> <tr> <td> <p>Pkt Len Min</p> </td> <td> <p>Minimum length of a packet</p> </td> </tr> <tr> <td> <p>Pkt Len Max</p> </td> <td> <p>Maximum length of a packet</p> </td> </tr> <tr> <td> <p>Pkt Len Mean</p> </td> <td> <p>Mean length of a packet</p> </td> </tr> <tr> <td> <p>Pkt Len Std</p> </td> <td> <p>Standard deviation length of a packet</p> </td> </tr> <tr> <td> <p>Pkt Len Var</p> </td> <td> <p>Variance length of a packet</p> </td> </tr> <tr> <td> <p>FIN Flag Cnt</p> </td> <td> <p>Number of packets with FIN</p> </td> </tr> <tr> <td> <p>SYN Flag Cnt</p> </td> <td> <p>Number of packets with SYN</p> </td> </tr> <tr> <td> <p>RST Flag Cnt</p> </td> <td> <p>Number of packets with RST</p> </td> </tr> <tr> <td> <p>PSH Flag Cnt</p> </td> <td> <p>Number of packets with PUSH</p> </td> </tr> <tr> <td> <p>ACK Flag Cnt</p> </td> <td> <p>Number of packets with ACK</p> </td> </tr> <tr> <td> <p>URG Flag Cnt</p> </td> <td> <p>Number of packets with URG</p> </td> </tr> <tr> <td> <p>CWE Flag Count</p> </td> <td> <p>Number of packets with CWE</p> </td> </tr> <tr> <td> <p>ECE Flag Cnt</p> </td> <td> <p>Number of packets with ECE</p> </td> </tr> <tr> <td> <p>Down/Up Ratio</p> </td> <td> <p>Download and upload ratio</p> </td> </tr> <tr> <td> <p>Pkt Size Avg</p> </td> <td> <p>Average size of packet</p> </td> </tr> <tr> <td> <p>Fwd Seg Size Avg</p> </td> <td> <p>Average size observed in the forward direction</p> </td> </tr> <tr> <td> <p>Bwd Seg Size Avg</p> </td> <td> <p>Average size observed in the backward direction</p> </td> </tr> <tr> <td> <p>Fwd Byts/b Avg</p> </td> <td> <p>Average number of bytes bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd Pkts/b Avg</p> </td> <td> <p>Average number of packets bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd Blk Rate Avg</p> </td> <td> <p>Average number of bulk rate in the forward direction</p> </td> </tr> <tr> <td> <p>Bwd Byts/b Avg</p> </td> <td> <p>Average number of bytes bulk rate in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd Pkts/b Avg</p> </td> <td> <p>Average number of packets bulk rate in the backward direction</p> </td> </tr> <tr> <td> <p>Bwd Blk Rate Avg</p> </td> <td> <p>Average number of bulk rate in the backward direction</p> </td> </tr> <tr> <td> <p>Subflow Fwd Pkts</p> </td> <td> <p>The average number of packets in a sub flow in the forward direction</p> </td> </tr> <tr> <td> <p>Subflow Fwd Byts</p> </td> <td> <p>The average number of bytes in a sub flow in the forward direction</p> </td> </tr> <tr> <td> <p>Subflow Bwd Pkts</p> </td> <td> <p>The average number of packets in a sub flow in the backward direction</p> </td> </tr> <tr> <td> <p>Subflow Bwd Byts</p> </td> <td> <p>The average number of bytes in a sub flow in the backward direction</p> </td> </tr> <tr> <td> <p>Init Fwd Win Byts</p> </td> <td> <p>The total number of bytes sent in initial window in the forward direction</p> </td> </tr> <tr> <td> <p>Init Bwd Win Byts</p> </td> <td> <p>The total number of bytes sent in initial window in the backward direction</p> </td> </tr> <tr> <td> <p>Fwd Act Data Pkts</p> </td> <td> <p>Count of packets with at least 1 byte of TCP data payload in the forward direction</p> </td> </tr> <tr> <td> <p>Fwd Seg Size Min</p> </td> <td> <p>Minimum segment size observed in the forward direction</p> </td> </tr> <tr> <td> <p>Active Mean</p> </td> <td> <p>Mean time a flow was active before becoming idle</p> </td> </tr> <tr> <td> <p>Active Std</p> </td> <td> <p>Standard deviation time a flow was active before becoming idle</p> </td> </tr> <tr> <td> <p>Active Max</p> </td> <td> <p>Maximum time a flow was active before becoming idle</p> </td> </tr> <tr> <td> <p>Active Min</p> </td> <td> <p>Minimum time a flow was active before becoming idle</p> </td> </tr> <tr> <td> <p>Idle Mean</p> </td> <td> <p>Mean time a flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>Idle Std</p> </td> <td> <p>Standard deviation time a flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>Idle Max</p> </td> <td> <p>Maximum time a flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>Idle Min</p> </td> <td> <p>Minimum time a flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>Label</p> </td> <td> <p>Attack label</p> </td> </tr> </tbody> </table> <p>The DNP3 flow statistics generated by the DNP3 Python Parser are summarised below. <strong>T</strong><strong>he DNP3 flows and their statistics generated by the DNP3 Python Parser are labelled based on the DNP3 attacks described above, thus allowing the training of ML/DL models. </strong><strong>Finally, it is worth mentioning that these statistics are available for various flow timeout values, such as 45, 60, 75, 90, 120 and 240 seconds.</strong></p> <p>Table 3: DNP3 Flow Statistics – Features</p> <table> <tbody> <tr> <td> <p><strong>Feature</strong></p> </td> <td> <p><strong>Field description</strong></p> </td> </tr> <tr> <td> <p>flow ID</p> </td> <td> <p>ID of the flow</p> </td> </tr> <tr> <td> <p>source IP</p> </td> <td> <p>Source IP address</p> </td> </tr> <tr> <td> <p>destination IP</p> </td> <td> <p>Destination IP address</p> </td> </tr> <tr> <td> <p>source port</p> </td> <td> <p>Source TCP/UDP Port</p> </td> </tr> <tr> <td> <p>destination port</p> </td> <td> <p>Destination TCP/UDP port</p> </td> </tr> <tr> <td> <p>protocol</p> </td> <td> <p>The protocol related to the corresponding flow</p> </td> </tr> <tr> <td> <p>date</p> </td> <td> <p>Flow timestamp</p> </td> </tr> <tr> <td> <p>TotalFwdPkts</p> </td> <td> <p>The total number of the DNP3 packets in the forward direction</p> </td> </tr> <tr> <td> <p>TotalBwdPkts</p> </td> <td> <p>The total number of the DNP3 packets in the backyard direction</p> </td> </tr> <tr> <td> <p>TotLenfwdDL</p> </td> <td> <p>The total size of the DNP3 payload at the link layer in the forward direction</p> </td> </tr> <tr> <td> <p>TotLenfwdTR</p> </td> <td> <p>The total size of the DNP3 payload at the transport layer in the forward direction</p> </td> </tr> <tr> <td> <p>TotLenfwdAPP</p> </td> <td> <p>The total size of the DNP3 payload at the application layer in the forward direction</p> </td> </tr> <tr> <td> <p>TotLenbwdDL</p> </td> <td> <p>The total size of the DNP3 payload at the link layer in the backyard direction</p> </td> </tr> <tr> <td> <p>TotLenbwdTR</p> </td> <td> <p>The total size of the DNP3 payload at the transport layer in the backyard direction</p> </td> </tr> <tr> <td> <p>TotLenbwdAPP</p> </td> <td> <p>The total size of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>DLfwdPktLenMAX</p> </td> <td> <p>The maximum size of the DNP3 payload at the link layer in the forward direction</p> </td> </tr> <tr> <td> <p>DLfwdPktLenMIN</p> </td> <td> <p>The minimum size of the DNP3 payload at the link layer in the forward direction</p> </td> </tr> <tr> <td> <p>DLfwdPktLenMEAN</p> </td> <td> <p>The mean of the DNP3 payload at the link layer in the forward direction</p> </td> </tr> <tr> <td> <p>DLfwdPktLenSTD</p> </td> <td> <p>The standard deviation of the DNP3 payload at the link layer in the forward direction</p> </td> </tr> <tr> <td> <p>TRfwdPktLenMAX</p> </td> <td> <p>The maximum size of the DNP3 payload at the transport layer in the forward direction</p> </td> </tr> <tr> <td> <p>TRfwdPktLenMIN</p> </td> <td> <p>The minimum size of the DNP3 payload at the transport layer in the forward direction</p> </td> </tr> <tr> <td> <p>TRfwdPktLenMEAN</p> </td> <td> <p>The mean of the DNP3 payload at the transport layer in the forward direction</p> </td> </tr> <tr> <td> <p>TRfwdPktLenSTD</p> </td> <td> <p>The standard deviation of the DNP3 payload at the transport layer in the forward direction</p> </td> </tr> <tr> <td> <p>APPfwdPktLenMAX</p> </td> <td> <p>The maximum size of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>APPfwdPktLenMIN</p> </td> <td> <p>The minimum size of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>APPfwdPktLenMEAN</p> </td> <td> <p>The mean of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>APPfwdPktLenSTD</p> </td> <td> <p>The standard deviation of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>DLbwdPktLenMAX</p> </td> <td> <p>The maximum size of the DNP3 payload at the link layer in the backyard direction</p> </td> </tr> <tr> <td> <p>DLbwdPktLenMIN</p> </td> <td> <p>The minimum size of the DNP3 payload at the link layer in the backyard direction</p> </td> </tr> <tr> <td> <p>DLbwdPktLenMEAN</p> </td> <td> <p>The mean of the DNP3 payload at the link layer in the backyard direction</p> </td> </tr> <tr> <td> <p>DLbwdPktLenSTD</p> </td> <td> <p>The standard deviation of the DNP3 payload at the link layer in the backyard direction</p> </td> </tr> <tr> <td> <p>TRbwdPktLenMAX</p> </td> <td> <p>The maximum size of the DNP3 payload at the transport layer in the backyard direction</p> </td> </tr> <tr> <td> <p>TRbwdPktLenMIN</p> </td> <td> <p>The minimum size of the DNP3 payload at the transport layer in the backyard direction</p> </td> </tr> <tr> <td> <p>TRbwdPktLenMEAN</p> </td> <td> <p>The mean of the DNP3 payload at the transport layer in the backyard direction</p> </td> </tr> <tr> <td> <p>TRbwdPktLenSTD</p> </td> <td> <p>The standard deviation of the DNP3 payload at the transport layer in the backyard direction</p> </td> </tr> <tr> <td> <p>APPbwdPktLenMAX</p> </td> <td> <p>The maximum size of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>APPbwdPktLenMIN</p> </td> <td> <p>The minimum size of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>APPbwdPktLenMEAN</p> </td> <td> <p>The mean of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>APPbwdPktLenSTD</p> </td> <td> <p>The standard deviation of the DNP3 payload at the application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>DLflowBytes/sec</p> </td> <td> <p>How many bytes of the DNP3 link-layer were transmitted per second</p> </td> </tr> <tr> <td> <p>TRflowBytes/sec</p> </td> <td> <p>How many bytes of the DNP3 transport layer were transmitted per second</p> </td> </tr> <tr> <td> <p>APPflowBytes/sec</p> </td> <td> <p>How many bytes of the DNP3 application layer were transmitted per second</p> </td> </tr> <tr> <td> <p>FlowPkts/sec</p> </td> <td> <p>How many DNP3 packets were transmitted per second</p> </td> </tr> <tr> <td> <p>FlowIAT_MEAN</p> </td> <td> <p>The mean of the DNP3 packets interarrival time</p> </td> </tr> <tr> <td> <p>FlowIAT_STD</p> </td> <td> <p>The standard deviation of the DNP3 packets interarrival time</p> </td> </tr> <tr> <td> <p>FlowIAT_MAX</p> </td> <td> <p>The maximum value of the DNP3 packets interarrival time</p> </td> </tr> <tr> <td> <p>FlowIAT_MIN</p> </td> <td> <p>The minimum value of the DNP3 packets interarrival time</p> </td> </tr> <tr> <td> <p>TotalFwdIAT</p> </td> <td> <p>The sum of the DNP3 packets interarrival time in the forward direction</p> </td> </tr> <tr> <td> <p>fwdIAT_MEAN</p> </td> <td> <p>The mean of the DNP3 packets interarrival time in the forward direction</p> </td> </tr> <tr> <td> <p>fwdIAT_STD</p> </td> <td> <p>The standard deviation of the DNP3 packets interarrival time in the forward direction</p> </td> </tr> <tr> <td> <p>fwdIAT_MAX</p> </td> <td> <p>The maximum value of the DNP3 packets interarrival time in the forward direction</p> </td> </tr> <tr> <td> <p>fwdIAT_MIN</p> </td> <td> <p>The minimum value of the DNP3 packets interarrival time in the forward direction</p> </td> </tr> <tr> <td> <p>TotalBwdIAT</p> </td> <td> <p>The sum of the DNP3 packets interarrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>bwdIAT_MEAN</p> </td> <td> <p>The mean of the DNP3 packets interarrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>bwdIAT_STD</p> </td> <td> <p>The standard deviation of the DNP3 packets interarrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>bwdIAT_MAX</p> </td> <td> <p>The maximum value of the DNP3 packets interarrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>bwdIAT_MIN</p> </td> <td> <p>The minimum value of the DNP3 packets interarrival time in the backyard direction</p> </td> </tr> <tr> <td> <p>DLfwdHdrLen</p> </td> <td> <p>The sum of the DNP3 headers at the link layer in the forward direction</p> </td> </tr> <tr> <td> <p>TRfwdHdrLen</p> </td> <td> <p>The sum of the DNP3 headers at the transport layer in the forward direction</p> </td> </tr> <tr> <td> <p>APPfwdHdrLen</p> </td> <td> <p>The sum of the DNP3 headers at the application layer in the forward direction</p> </td> </tr> <tr> <td> <p>DLbwdHdrLen</p> </td> <td> <p>The sum of the DNP3 headers at the link layer in the backyard direction</p> </td> </tr> <tr> <td> <p>TRbwdHdrLen</p> </td> <td> <p>The sum of the DNP3 headers at the transport layer in the backyard direction</p> </td> </tr> <tr> <td> <p>APPbwdHdrLen</p> </td> <td> <p>The sum of the DNP3 headers at the</p> <p>application layer in the backyard direction</p> </td> </tr> <tr> <td> <p>fwdPkts/sec</p> </td> <td> <p>How many DNP3 packets per second in the forward direction</p> </td> </tr> <tr> <td> <p>bwdPkts/sec</p> </td> <td> <p>How many DNP3 packets per second in the backyard direction</p> </td> </tr> <tr> <td> <p>DLpktLenMEAN</p> </td> <td> <p>The mean of the bytes at the DNP3 link layer</p> </td> </tr> <tr> <td> <p>DLpktLenMIN</p> </td> <td> <p>The minimum value of the bytes at the DNP3 link layer</p> </td> </tr> <tr> <td> <p>DLpktLenMAX</p> </td> <td> <p>The maximum value of the bytes at the DNP3 link layer</p> </td> </tr> <tr> <td> <p>DLpktLenSTD</p> </td> <td> <p>The standard deviation of the bytes at the DNP3 link layer</p> </td> </tr> <tr> <td> <p>DLpktLenVAR</p> </td> <td> <p>The variance of the bytes at the DNP3 link layer</p> </td> </tr> <tr> <td> <p>TRpktLenMEAN</p> </td> <td> <p>The mean of the bytes at the DNP3 transport layer</p> </td> </tr> <tr> <td> <p>TRpktLenMIN</p> </td> <td> <p>The minimum value of the bytes at the DNP3 transport layer</p> </td> </tr> <tr> <td> <p>TRpktLenMAX</p> </td> <td> <p>The maximum value of the bytes at the DNP3 transport layer</p> </td> </tr> <tr> <td> <p>TRpktLenSTD</p> </td> <td> <p>The standard deviation of the bytes at the DNP3 transport layer</p> </td> </tr> <tr> <td> <p>TRpktLenVAR</p> </td> <td> <p>The variance of the bytes at the DNP3 transport layer</p> </td> </tr> <tr> <td> <p>APPpktLenMEAN</p> </td> <td> <p>The mean of the bytes at the DNP3 application layer</p> </td> </tr> <tr> <td> <p>APPpktLenMIN</p> </td> <td> <p>The minimum value of the bytes at the DNP3 application layer</p> </td> </tr> <tr> <td> <p>APPpktLenMAX</p> </td> <td> <p>The maximum value of the bytes at the DNP3 application layer</p> </td> </tr> <tr> <td> <p>APPpktLenSTD</p> </td> <td> <p>The standard deviation of the bytes at the DNP3 application layer</p> </td> </tr> <tr> <td> <p>APPpktLenVAR</p> </td> <td> <p>The variance of the bytes at the DNP3 application layer</p> </td> </tr> <tr> <td> <p>ActiveMEAN</p> </td> <td> <p>The time-mean where the flow was active</p> </td> </tr> <tr> <td> <p>ActiveSTD</p> </td> <td> <p>The time standard deviation where the flow was active</p> </td> </tr> <tr> <td> <p>ActiveMAX</p> </td> <td> <p>The maximum value of the time where the flow is active</p> </td> </tr> <tr> <td> <p>ActiveMIN</p> </td> <td> <p>The maximum value of the time where the flow is idle.</p> </td> </tr> <tr> <td> <p>IdleMEAN</p> </td> <td> <p>The time-mean where the flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>IdleSTD</p> </td> <td> <p>The standard deviation of the time where the flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>IdleMAX</p> </td> <td> <p>The maximum value of the time where the flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>IdleMIN</p> </td> <td> <p>The minimum value of the time where the flow was idle before becoming active</p> </td> </tr> <tr> <td> <p>frameSrc</p> </td> <td> <p>The source MAC address</p> </td> </tr> <tr> <td> <p>frameDst</p> </td> <td> <p>The destination MAC address</p> </td> </tr> <tr> <td> <p>TotPktsInFlow</p> </td> <td> <p>The total number of the DNP3 packets</p> </td> </tr> <tr> <td> <p>firstPacketDIR</p> </td> <td> <p>Whether the flow was initiated by a DNP3 master device or DNP3 slave device</p> </td> </tr> <tr> <td> <p>mostCommonREQ_FUNC_CODE</p> </td> <td> <p>The DNP3 function code which was used mostly in the DNP3 request packets</p> </td> </tr> <tr> <td> <p>mostCommonRESP_FUNC_CODE</p> </td> <td> <p>The DNP3 function code which was used mostly in the DNP3 response packets</p> </td> </tr> <tr> <td> <p>corruptConfigFragments</p> </td> <td> <p>How many responses were sent by the slave, setting the corruptConfig bit in the IIN value</p> </td> </tr> <tr> <td> <p>deviceTroubleFragments</p> </td> <td> <p>How many responses were sent by the slave, setting the deviceTrouble bit in the IIN value</p> </td> </tr> <tr> <td> <p>deviceRestartFragments</p> </td> <td> <p>How many responses were sent by the slave, setting the deviceRestart bit in the IIN value</p> </td> </tr> <tr> <td> <p>pktsFromMASTER</p> </td> <td> <p>How many packets that transmitted by a DNP3 master device</p> </td> </tr> <tr> <td> <p>pktsFromSLAVE</p> </td> <td> <p>How many packets that transmitted by a DNP3 slave device</p> </td> </tr> <tr> <td> <p>Label</p> </td> <td> <p>Attack label</p> </td> </tr> </tbody> </table> <p>6.Citation</p> <p>The users of this dataset are kindly asked to cite the following papers as follows.</p> <p>V. Kelli et al., "Attacking and Defending DNP3 ICS/SCADA Systems", 2022 18th International Conference on Distributed Computing in Sensor Systems (DCOSS), 2022, pp. 183-190, doi: 10.1109/DCOSS54816.2022.00041.</p> <p>V. Kelli, P. Radoglou-Grammatikis, T. Lagkas, E. K. Markakis and P. Sarigiannidis, "Risk Analysis of DNP3 Attacks", 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 2022, pp. 351-356, doi: 10.1109/CSR54599.2022.9850291.</p> <p>P. Radoglou-Grammatikis, P. Sarigiannidis, G. Efstathopoulos, P.-A.Karypidis, and A. Sarigiannidis, "Diderot: An intrusion detection and prevention system for dnp3-based scada systems", in Proceedings of the15th International Conference on Availability, Reliability and Security, ser. ARES ’20.New York, NY, USA: Association for Computing Machinery, 2020, doi: 10.1145/3407023.3409314.</p> <p>7. Acknowledgment</p> <p>This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreements No 101021936 (ELECTRON) and No 833955 (SDN-microSENSE).</p> <p>References</p> <ol> <li>V. Kelli et al., "Attacking and Defending DNP3 ICS/SCADA Systems", 2022 18th International Conference on Distributed Computing in Sensor Systems (DCOSS), 2022, pp. 183-190, doi: 10.1109/DCOSS54816.2022.00041.</li> <li>V. Kelli, P. Radoglou-Grammatikis, T. Lagkas, E. K. Markakis and P. Sarigiannidis, "Risk Analysis of DNP3 Attacks", 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 2022, pp. 351-356, doi: 10.1109/CSR54599.2022.9850291.</li> <li>P. Radoglou-Grammatikis, P. Sarigiannidis, G. Efstathopoulos, P.-A.Karypidis, and A. Sarigiannidis, "Diderot: An intrusion detection and prevention system for dnp3-based scada systems", in Proceedings of the15th International Conference on Availability, Reliability and Security, ser. ARES ’20.New York, NY, USA: Association for Computing Machinery, 2020, doi: 10.1145/3407023.3409314.</li> <li>A. Gharib, I. Sharafaldin, A. H. Lashkari and A. A. Ghorbani, "An Evaluation Framework for Intrusion Detection Dataset", 2016 International Conference on Information Science and Security (ICISS), 2016, pp. 1-6, doi: 10.1109/ICISSEC.2016.7885840.</li> <li>S. Dadkhah, H. Mahdikhani, P. K. Danso, A. Zohourian, K. A. Truong and A. A. Ghorbani, "Towards the Development of a Realistic Multidimensional IoT Profiling Dataset", 2022 19th Annual International Conference on Privacy, Security & Trust (PST), 2022, pp. 1-11, doi: 10.1109/PST55820.2022.9851966.</li> </ol>
5GC PFCP Intrusion Detection Dataset
<p>The 5GC PFCP Intrusion Detection Dataset was implemented following relevant methodological frameworks, including eleven features: (a) Complete Network Configuration, (b) Complete Traffic, (c) Labelled Dataset, (d) Complete Interaction, (e) Complete Capture, (f) Available Protocols, (g) Attack Diversity, (h) Heterogeneity, (i) Feature Set and (j) Metadata. A 5GC architecture was emulated, including the Network Slice Selection Function (NSSF), the Network Exposure Function (NEF), the Network Repository Function (NRF), the Policy Control Function (PCF), the User Data Management (UDM), the Access and Mobility Management Function (AF), the Authentication Server Function (AUSF), the Access Management Function (AMF), SMF, and UPF, in addition to a virtualised UE device, a virtualised gNodeB (gNB), and a cyberattacker impersonating a maliciously instantiated SMF. In particular, the following cyberattacks were performed:</p> <ul> <li>On Wednesday, October 05, 2022, the PFCP Session Establishment DoS Attack was implemented for 4 hours.</li> <li>On Thursday, October 13, 2022, the PFCP Session Deletion DoS Attack was implemented for four hours.</li> <li>On Tuesday, November 01, 2022, the PFCP Session Modification DoS Attack (DROP Apply Action Field Flags) was implemented for 4 hours.</li> <li>On Tuesday, November 22, 2022, the PFCP Session Modification DoS Attack (DUPL Apply Action Field Flag) was implemented for 4 hours.</li> </ul> <p>The previous PFCP-related cyberattacks were executed, utilising penetration testing tools, such as Scapy. For each attack, a relevant folder is provided, including the network traffic and the network flow statistics for each entity. In particular, for each cyberattack, a folder is given, providing (a) the pcap files for each entity, (b) the Transmission Control Protocol (TCP)/ Internet Protocol (IP) network flow statistics for 120 seconds in a Comma-Separated Values (CSV) format and (c) the PFCP flow statistics for each entity (using different timeout values in terms of second (such as 45, 60, 75, 90, 120 and 240 seconds)). The TCP/IP network flow statistics were produced by using the CICFlowMeter, while the PFCP flow statistics were generated based on a Custom PFCP Flow Generator, taking full advantage of Scapy.</p> <p><strong>The users of this dataset are kindly asked to cite the following paper(s).</strong></p> <p><em>G. Amponis, P. Radoglou-Grammatikis, T. Lagkas, W. Mallouli, A. Cavalli, D. Klonidis, E. Markakis, and P. Sarigiannidis, “Threatening the 5G core via PFCP DOS attacks: The case of blocking UAV Communications”, EURASIP Journal on Wireless Communications and Networking, vol. 2022, no. 1, 2022, doi: 10.1186/s13638-022-02204-5.</em></p>
IoMT-TrafficData: A Dataset for Benchmarking Intrusion Detection in IoMT
<h3><strong>Article Information<br></strong></h3> <p>The work involved in developing the dataset and benchmarking its use of machine learning is set out in the article ‘IoMT-TrafficData: Dataset and Tools for Benchmarking Intrusion Detection in Internet of Medical Things’. DOI: 10.1109/ACCESS.2024.3437214.</p> <p>Please do cite the aforementioned article when using this dataset. </p> <h3><strong>Abstract</strong></h3> <p>The increasing importance of securing the Internet of Medical Things (IoMT) due to its vulnerabilities to cyber-attacks highlights the need for an effective intrusion detection system (IDS). In this study, our main objective was to develop a Machine Learning Model for the IoMT to enhance the security of medical devices and protect patients’ private data. To address this issue, we built a scenario that utilised the Internet of Things (IoT) and IoMT devices to simulate real-world attacks. We collected and cleaned data, pre-processed it, and provided it into our machine-learning model to detect intrusions in the network. Our results revealed significant improvements in all performance metrics, indicating robustness and reproducibility in real-world scenarios. This research has implications in the context of IoMT and cybersecurity, as it helps mitigate vulnerabilities and lowers the number of breaches occurring with the rapid growth of IoMT devices. The use of machine learning algorithms for intrusion detection systems is essential, and our study provides valuable insights and a road map for future research and the deployment of such systems in live environments. By implementing our findings, we can contribute to a safer and more secure IoMT ecosystem, safeguarding patient privacy and ensuring the integrity of medical data.</p> <h3><strong>ZIP Folder Content</strong></h3> <p>The ZIP folder comprises two main components: <strong>Captures</strong> and <strong>Datasets</strong>. Within the captures folder, we have included all the captures used in this project. These captures are organized into separate folders corresponding to the type of network analysis: BLE or IP-Based. Similarly, the datasets folder follows a similar organizational approach. It contains datasets categorized by type: <strong>BLE</strong>, <strong>IP-Based Packet</strong>, and <strong>IP-Based Flows</strong>.</p> <p>To cater to diverse analytical needs, the datasets are provided in two formats: CSV (Comma-Separated Values) and pickle. The CSV format facilitates seamless integration with various data analysis tools, while the pickle format preserves the intricate structures and relationships within the dataset.</p> <p>This organization enables researchers to easily locate and utilize the specific captures and datasets they require, based on their preferred network analysis type or dataset type. The availability of different formats further enhances the flexibility and usability of the provided data.</p> <h3><strong>Datasets' Content</strong></h3> <p>Within this dataset, three sub-datasets are available, namely <strong>BLE, IP-Based Packet, and IP-Based Flows</strong>. Below is a table of the features selected for each dataset and consequently used in the evaluation model within the provided work.</p> <p>Identified Key Features Within Bluetooth Dataset</p> <table> <tbody> <tr> <td><strong>Feature</strong></td> <td><strong>Meaning</strong></td> </tr> <tr> <td>btle.advertising_header</td> <td>BLE Advertising Packet Header</td> </tr> <tr> <td>btle.advertising_header.ch_sel</td> <td>BLE Advertising Channel Selection Algorithm</td> </tr> <tr> <td>btle.advertising_header.length</td> <td>BLE Advertising Length</td> </tr> <tr> <td>btle.advertising_header.pdu_type</td> <td>BLE Advertising PDU Type</td> </tr> <tr> <td>btle.advertising_header.randomized_rx</td> <td>BLE Advertising Rx Address</td> </tr> <tr> <td>btle.advertising_header.randomized_tx</td> <td>BLE Advertising Tx Address</td> </tr> <tr> <td>btle.advertising_header.rfu.1</td> <td>Reserved For Future 1</td> </tr> <tr> <td>btle.advertising_header.rfu.2</td> <td>Reserved For Future 2</td> </tr> <tr> <td>btle.advertising_header.rfu.3</td> <td>Reserved For Future 3</td> </tr> <tr> <td>btle.advertising_header.rfu.4</td> <td>Reserved For Future 4</td> </tr> <tr> <td>btle.control.instant</td> <td>Instant Value Within a BLE Control Packet</td> </tr> <tr> <td>btle.crc.incorrect</td> <td>Incorrect CRC</td> </tr> <tr> <td>btle.extended_advertising</td> <td>Advertiser Data Information</td> </tr> <tr> <td>btle.extended_advertising.did</td> <td>Advertiser Data Identifier</td> </tr> <tr> <td>btle.extended_advertising.sid</td> <td>Advertiser Set Identifier</td> </tr> <tr> <td>btle.length</td> <td>BLE Length</td> </tr> <tr> <td>frame.cap_len</td> <td>Frame Length Stored Into the Capture File</td> </tr> <tr> <td>frame.interface_id</td> <td>Interface ID</td> </tr> <tr> <td>frame.len</td> <td>Frame Length Wire</td> </tr> <tr> <td>nordic_ble.board_id</td> <td>Board ID</td> </tr> <tr> <td>nordic_ble.channel</td> <td>Channel Index</td> </tr> <tr> <td>nordic_ble.crcok</td> <td>Indicates if CRC is Correct</td> </tr> <tr> <td>nordic_ble.flags</td> <td>Flags</td> </tr> <tr> <td>nordic_ble.packet_counter</td> <td>Packet Counter</td> </tr> <tr> <td>nordic_ble.packet_time</td> <td>Packet time (start to end)</td> </tr> <tr> <td>nordic_ble.phy</td> <td>PHY</td> </tr> <tr> <td>nordic_ble.protover</td> <td>Protocol Version</td> </tr> </tbody> </table> <p> </p> <p>Identified Key Features Within IP-Based Packets Dataset</p> <table> <tbody> <tr> <td><strong>Feature</strong></td> <td><strong>Meaning</strong></td> </tr> <tr> <td>http.content_length</td> <td>Length of content in an HTTP response</td> </tr> <tr> <td>http.request</td> <td>HTTP request being made</td> </tr> <tr> <td>http.response.code</td> <td>Sequential number of an HTTP response</td> </tr> <tr> <td>http.response_number</td> <td>Sequential number of an HTTP response</td> </tr> <tr> <td>http.time</td> <td>Time taken for an HTTP transaction</td> </tr> <tr> <td>tcp.analysis.initial_rtt</td> <td>Initial round-trip time for TCP connection</td> </tr> <tr> <td>tcp.connection.fin</td> <td>TCP connection termination with a FIN flag</td> </tr> <tr> <td>tcp.connection.syn</td> <td>TCP connection initiation with SYN flag</td> </tr> <tr> <td>tcp.connection.synack</td> <td>TCP connection establishment with SYN-ACK flags</td> </tr> <tr> <td>tcp.flags.cwr</td> <td>Congestion Window Reduced flag in TCP</td> </tr> <tr> <td>tcp.flags.ecn</td> <td>Explicit Congestion Notification flag in TCP</td> </tr> <tr> <td>tcp.flags.fin</td> <td>FIN flag in TCP</td> </tr> <tr> <td>tcp.flags.ns</td> <td>Nonce Sum flag in TCP</td> </tr> <tr> <td>tcp.flags.res</td> <td>Reserved flags in TCP</td> </tr> <tr> <td>tcp.flags.syn</td> <td>SYN flag in TCP</td> </tr> <tr> <td>tcp.flags.urg</td> <td>Urgent flag in TCP</td> </tr> <tr> <td>tcp.urgent_pointer</td> <td>Pointer to urgent data in TCP</td> </tr> <tr> <td>ip.frag_offset</td> <td>Fragment offset in IP packets</td> </tr> <tr> <td>eth.dst.ig</td> <td>Ethernet destination is in the internal network group</td> </tr> <tr> <td>eth.src.ig</td> <td>Ethernet source is in the internal network group</td> </tr> <tr> <td>eth.src.lg</td> <td>Ethernet source is in the local network group</td> </tr> <tr> <td>eth.src_not_group</td> <td>Ethernet source is not in any network group</td> </tr> <tr> <td>arp.isannouncement</td> <td>Indicates if an ARP message is an announcement</td> </tr> </tbody> </table> <p> </p> <p>Identified Key Features Within IP-Based Flows Dataset</p> <table> <tbody> <tr> <td><strong>Feature</strong></td> <td><strong>Meaning</strong></td> </tr> <tr> <td>proto</td> <td>Transport layer protocol of the connection</td> </tr> <tr> <td>service</td> <td>Identification of an application protocol</td> </tr> <tr> <td>orig_bytes</td> <td>Originator payload bytes</td> </tr> <tr> <td>resp_bytes</td> <td>Responder payload bytes</td> </tr> <tr> <td>history</td> <td>Connection state history</td> </tr> <tr> <td>orig_pkts</td> <td>Originator sent packets</td> </tr> <tr> <td>resp_pkts</td> <td>Responder sent packets</td> </tr> <tr> <td>flow_duration</td> <td>Length of the flow in seconds</td> </tr> <tr> <td>fwd_pkts_tot</td> <td>Forward packets total</td> </tr> <tr> <td>bwd_pkts_tot</td> <td>Backward packets total</td> </tr> <tr> <td>fwd_data_pkts_tot</td> <td>Forward data packets total</td> </tr> <tr> <td>bwd_data_pkts_tot</td> <td>Backward data packets total</td> </tr> <tr> <td>fwd_pkts_per_sec</td> <td>Forward packets per second</td> </tr> <tr> <td>bwd_pkts_per_sec</td> <td>Backward packets per second</td> </tr> <tr> <td>flow_pkts_per_sec</td> <td>Flow packets per second</td> </tr> <tr> <td>fwd_header_size</td> <td>Forward header bytes</td> </tr> <tr> <td>bwd_header_size</td> <td>Backward header bytes</td> </tr> <tr> <td>fwd_pkts_payload</td> <td>Forward payload bytes</td> </tr> <tr> <td>bwd_pkts_payload</td> <td>Backward payload bytes</td> </tr> <tr> <td>flow_pkts_payload</td> <td>Flow payload bytes</td> </tr> <tr> <td>fwd_iat</td> <td>Forward inter-arrival time</td> </tr> <tr> <td>bwd_iat</td> <td>Backward inter-arrival time</td> </tr> <tr> <td>flow_iat</td> <td>Flow inter-arrival time</td> </tr> <tr> <td>active</td> <td>Flow active duration</td> </tr> </tbody> </table>
Process Mining Algorithm for Online Intrusion Detection System
<p>The pre-processed data we used in the paper.</p>
Non-intrusive Detection of Temporary Neurologic Impairment By Opioids
ClinicalTrials.gov study NCT04223609. IPD Sharing: NO. Countries: 1. Publications: 0.
Tagged formatted datasets for 'Genetically Optimized Massively Parallel Binary Neural Networks for Intrusion Detection Systems'
<p>Tagged formatted datasets used in 'Genetically Optimized Massively Parallel Binary Neural Networks for Intrusion Detection Systems' T.Murovič, A.Trost.</p>
Non-intrusive Detection of Temporary Neurologic Impairment by Opioids
ClinicalTrials.gov study NCT05489601. IPD Sharing: UNDECIDED. Countries: 1. Publications: 0.
Dataset for Network Intrusion Detection System on SCADA IEC 60870-5-104
<p>Security is the main challenge in Supervisory Control and Data Acquisition (SCADA) systems since SCADA systems must be connected to heterogeneous networks to save costs. SCADA devices such as RTUs have limited resources, so a small-scale cyber attack on a computer network will have a major impact on the SCADA system. This study discusses the SCADA system with the IEC 60870-5-104 protocol which is widely used in the power plant industry. A physical testbed is built to simulate the electrical distribution process. The SCADA system in the distribution section is more vulnerable than other parts because it is located directly in the community environment so that many holes can be entered by attackers. The purpose of this study is to obtain relevant datasets in the SCADA system. The simulation carried out in this study is a normal communication between the HMI and the RTU, then attacked to disrupt the communication. The attack activities carried out are port scan, brute force and DoS. DoS attacks carried out are ICMP flood, Syn flood, and IEC 104 flood. IEC 104 flood attack is a modified attack to attack RTU where RTU is flooded with an unknown typeid ASDU (Application Service Data Unit). Attacks are carried out using Kali Linux operating system. All scenarios are recorded and saved in pcap. To prove that there is attack data traffic on the IDS dataset Snort and Suricata are used to detect it. In this study, there are also intrusion detection performance results from Snort and Suricata</p>
ScienceDex guides
Understand access before you commit
These curated guides explain access requirements, typical timelines, costs, and reuse considerations for widely used research datasets.
Allen Brain Atlas
Allen Brain Atlas is an Allen Institute collection of brain map atlases, datasets, APIs, and analysis tools covering mouse, human, and non-human primate brain resources.
Annotated Behaviour and Observability Dataset (ABODe)
ABODe is a University of Edinburgh DataShare dataset for behavior classification in group-housed mice using home-cage video, identities, bounding boxes, ground-plate positions, and annotator labels.
DANDI Archive for NWB datasets
DANDI is a BRAIN Initiative archive for publishing and sharing neurophysiology data, including electrophysiology, optophysiology, and behavioral data packaged as NWB and related standards.
International Brain Laboratory public data
The International Brain Laboratory public data releases expose standardized mouse decision-making experiments, including Neuropixels recordings, widefield calcium imaging, behavior, and session metadata accessed through the ONE API.
OpenNeuro
OpenNeuro is a free, open platform for sharing neuroimaging datasets, with public search, dataset pages, and download paths for web, S3, DataLad, and the OpenNeuro CLI.