Cyber4OT dataset: Network traces for cyber-security vulnerability evaluation in industrial control systems

The article introduces the Cyber4OT dataset containing network traces concerning normal and simulated attacker-hostile activity in an Industrial Control System (ICS) environment. As many as 96 traces contain over 4.25 million packets and have over 385 MB capacity. The simulated attacks have been performed on a dedicated laboratory testbed. The testbed mimics industrial plants’ Information Technology (IT) and Operational Technology (OT) infrastructure. The testbed deliberately uses continuous and binary control processes of fast and slow dynamics. Industrial Programmable Logic Controllers (PLCs) are used to control the processes. A dedicated industrial network provides the communication between the ICS equipment, Supervisory Control and Data Acquisition (SCADA) system and Human Machine Interface (HMI) panels. The communication is configured to test multiple communication protocols, including the standard industrial Modbus protocol. The entire industrial infrastructure is connected to an external office network. Since the infrastructure and its components are typical of industrial solutions, the described dataset collected using such a realistic testbed could be beneficial for a broad scope of researchers to evaluate the vulnerability of ICSs to cyber attacks using classical and artificial intelligence methods.