Anomaly Detection Dataset for Industrial Control Systems
Alireza Dehlaghi-Ghadim Mahshid Helali Moghadam Ali Balador Hans Hansson
Over the past few decades, Industrial Control Systems (ICSs) have been
targeted by cyberattacks and are becoming increasingly vulnerable as more ICSs
are connected to the internet. Using Machine Learning (ML) for Intrusion
Detection Systems (IDS) is a promising approach for ICS cyber protection, but
the lack of suitable datasets for evaluating ML algorithms is a challenge.
Although there are a few commonly used datasets, they may not reflect realistic
ICS network data, lack necessary features for effective anomaly detection, or
be outdated. This paper presents the 'ICS-Flow' dataset, which offers network
data and process state variables logs for supervised and unsupervised ML-based
IDS assessment. The network data includes normal and anomalous network packets
and flows captured from simulated ICS components and emulated networks. The
anomalies were injected into the system through various attack techniques
commonly used by hackers to modify network traffic and compromise ICSs. We also
proposed open-source tools, `ICSFlowGenerator' for generating network flow
parameters from Raw network packets. The final dataset comprises over
25,000,000 raw network packets, network flow records, and process variable
logs. The paper describes the methodology used to collect and label the dataset
and provides a detailed data analysis. Finally, we implement several ML models,
including the decision tree, random forest, and artificial neural network to
detect anomalies and attacks, demonstrating that our dataset can be used
effectively for training intrusion detection ML models.