Datasets
Standard Dataset
IEC 60870-5-104 Intrusion Detection Dataset
- Citation Author(s):
-
PanagiotisRadoglou-Grammatikis
ThomasLagkasVasileiosArgyriouPanagiotisSarigiannidis - Submitted by:
- Panagiotis Sari...
- Last updated:
- Wed, 01/04/2023 - 13:05
- DOI:
- 10.21227/fj7s-f281
- Data Format:
- Links:
- License:
6628 Views- Categories:
- Keywords:
Abstract
The evolution of the Industrial Internet of Things (IIoT) introduces several benefits, such as real-time monitoring, pervasive control and self-healing. However, despite the valuable services, security and privacy issues still remain given the presence of legacy and insecure communication protocols like IEC 60870-5-104. IEC 60870-5-104 is an industrial protocol widely applied in critical infrastructures, such as the smart electrical grid and industrial healthcare systems. The IEC 60870-5-104 Intrusion Detection Dataset was implemented in the context of the research paper entitled "Modeling, Detecting, and Mitigating Threats Against Industrial Healthcare Systems: A Combined Software Defined Networking and Reinforcement Learning Approach", in the context of two H2020 projects: ELECTRON: rEsilient and seLf-healed EleCTRical pOwer Nanogrid (101021936) and SDN-microSENSE: SDN - microgrid reSilient Electrical eNergy SystEm (833955). This dataset includes labelled Transmission Control Protocol (TCP)/Internet Protocol (IP) network flow statistics (Common-Separated Values (CSV) format) and IEC 60870-5-104 flow statistics (CSV format) related to twelve IEC 60870-5-104 cyberattacks. In particular, the cyberattacks are related to unauthorised commands and Denial of Service (DoS) activities against IEC 60870-5-104. Moreover, the relevant Packet Capture (PCAP) files are available. The dataset can be utilised for Artificial Intelligence (AI)-based Intrusion Detection Systems (IDS), taking full advantage of Machine Learning (ML) and Deep Learning (DL).
The IEC 60870-5-104 dataset includes eleven features: (a) Complete Network Configuration, (b) Complete Traffic, (c) Labelled Dataset, (d) Complete Interaction, (e) Complete Capture, (f) Available Protocols, (g) Attack Diversity, (h) Heterogeneity, (i) Feature Set and (j) Metadata.
A network topology consisting of (a) seven industrial entities, (b) one Human Machine Interfaces (HMI) and (c) three cyberattackers, was used to construct the IEC 60870-5-104 Intrusion Detection Dataset. The industrial entities use IEC TestServer, while the HMI uses Qtester104. On the other hand, the cyberattackers use Kali Linux equipped with Metasploit, OpenMUC j60870 and Ettercap..
The dataset consists of the following files:
- 20200425_UOWM_IEC104_Dataset_m_sp_na_1_DoS.7z: A 7zip file including the pcap and CSV files related to the M_SP_NA_1 attack.
- 20200426_UOWM_IEC104_Dataset_c_ci_na_1_DoS.7z: A 7zip file including the pcap and CSV files related to the C_CI_NA_1_DoS attack.
- 20200426_UOWM_IEC104_Dataset_c_ci_na_1.7z: A 7zip file including the pcap and CSV files related to C_CI_NA_1 attack.
- 20200427_UOWM_IEC104_Dataset_c_se_na_1.7z: A 7zip file including the pcap and CSV files related to the C_SE_NA_1 attack.
- 20200428_UOWM_IEC104_Dataset_c_sc_na_1.7z: A 7zip file including the pcap and CSV files related to the C_SC_NA_1 attack.
- 20200428_UOWM_IEC104_Dataset_c_se_na_1_DoS.7z: A 7zip file including the pcap and CSV files related to the C_SE_NA_1_DoS attack.
- 20200429_UOWM_IEC104_Dataset_c_sc_na_1_DoS.7z: A 7zip file including the pcap and CSV files related to the C_SC_NA_1_DoS attack.
- 20200605_UOWM_IEC104_Dataset_c_rd_na_1_DoS.7z: A 7zip file including the pcap and CSV files related to the C_RD_NA_1_DoS attack.
- 20200605_UOWM_IEC104_Dataset_c_rd_na_1.7z: A 7zip file including the pcap and CSV files related to the C_RD_NA_1 attack.
- 20200606_UOWM_IEC104_Dataset_c_rp_na_1_DoS.7z: A 7zip file including the pcap and CSV files related to the C_RP_NA_1_DoS attack.
- 20200606_UOWM_IEC104_Dataset_c_rp_na_1.7z: A 7zip file including the pcap and CSV files related to the C_RP_NA_1 attack.
- 20200608_UOWM_IEC104_Dataset_mitm_drop.7z: A 7zip file including the pcap and CSV files related to the MITM attack.
- Balanced_IEC104_Train_Test_CSV_Files.zip: This zip file includes balanced CSV files from CICFlowMeter and the Custom IEC 60870-5-104 Python Parser that could be utilised for training ML and DL methods. The zip file includes different folders for the corresponding flow timeout values used for CICFlowMeter and IEC 60870-5-104 Python Parser, respectively.
Each 7zip file includes respective folders related to the entities/devices (described in the following section) participating in each attack. In particular, for each entity/device, there is a folder including (a) the overall network traffic (pcap file) related to this entity/device during each attack, (b) the TCP/IP network flow statistics (CSV file) from CICFlowMeter for the overall network traffic, (c) the IEC 60870-5-104 network traffic (pcap file) related to this entity/device during each attack, (d) the TCP/IP network flow statistics (CSV file) from CICFlowMeter for the IEC 608770-5-104 network traffic, (e) the IEC 60870-5-104 flow statistics (CSV file) from the Custom IEC 60870-5-104 Python Parser for the IEC 608770-5-104 network traffic and finally, (f) an image showing how the attack was executed. Finally, it is noteworthy that the network flow from both CICFlowMeter and Custom IEC 60870-5-104 Python Parser in each CSV file are labelled based on the IEC 60870-5-104 cyberattacks executed for the generation of this dataset.
Please cite the following paper when using this dataset:
P. Radoglou-Grammatikis, K. Rompolos, P. Sarigiannidis, V. Argyriou, T. Lagkas, A. Sarigiannidis, S. Goudos and S. Wan, "Modeling, Detecting, and Mitigating Threats Against Industrial Healthcare Systems: A Combined Software Defined Networking and Reinforcement Learning Approach", in IEEE Transactions on Industrial Informatics, vol. 18, no. 3, pp. 2041-2052, March 2022
doi: 10.1109/TII.2021.3093905
Dataset Files
- 20200425_UOWM_IEC104_Dataset_m_sp_na_1_DoS.7z (66.20 MB)
- 20200426_UOWM_IEC104_Dataset_c_ci_na_1.7z (67.91 MB)
- 20200426_UOWM_IEC104_Dataset_c_ci_na_1_DoS.7z (72.66 MB)
- 20200427_UOWM_IEC104_Dataset_c_se_na_1.7z (78.16 MB)
- 20200428_UOWM_IEC104_Dataset_c_sc_na_1.7z (78.83 MB)
- 20200428_UOWM_IEC104_Dataset_c_se_na_1_DoS.7z (77.08 MB)
- 20200429_UOWM_IEC104_Dataset_c_sc_na_1_DoS.7z (84.25 MB)
- 20200605_UOWM_IEC104_Dataset_c_rd_na_1.7z (99.72 MB)
- 20200605_UOWM_IEC104_Dataset_c_rd_na_1_DoS.7z (101.68 MB)
- 20200606_UOWM_IEC104_Dataset_c_rp_na_1.7z (102.06 MB)
- 20200606_UOWM_IEC104_Dataset_c_rp_na_1_DoS.7z (99.47 MB)
- 20200608_UOWM_IEC104_Dataset_mitm_drop.7z (97.58 MB)
- Balanced_IEC104_Train_Test_CSV_Files.7z (10.85 MB)
Documentation
| Attachment | Size |
|---|---|
 ReadMe.pdf | 415.88 KB |
Comments
...