IEC 61850 Process bus GOOSE attack datasets

The datasets were collected by operating the testbed (simulation of small-scale of IEC 61850-compliant SASs) under four types of behaviours: 1) normal operation when no unusual events happen; 2) emergency operation when non-malicious events (e.g., short-circuit faults) happen; 3) an attack under normal operation to disrupt energy transmission; and 4) an attack under emergency operation to stop protection mechanisms or trigger undesirable protection operations.

Based on these four types of behaviours, a total of 31 datasets were generated. Each dataset consists of network traffic and system logs (simulink).

Note: Since the testbed only models instantaneous overcurrent protection and circuit breaker failure protection, the sensor data only contains circuit current values from sensors at different locations and the operational status of various circuit breakers.