A Hardware-in-the-Loop Water Distribution Testbed Dataset for Cyber-Physical Security Testing

Abstract

This paper presents a dataset to support researchers in the validation process of solutions such as Intrusion Detection Systems (IDS) based on artificial intelligence and machine learning techniques for the detection and categorization of threats in Cyber Physical Systems (CPS). To this end, data have been acquired from a hardware-in-the-loop Water Distribution Testbed (WDT) which emulates water flowing between eight tanks via solenoid-valves, pumps, pressure and flow sensors. The testbed is composed of a real subsystem which is virtually connected to a simulated one. The proposed dataset encompasses both physical and network data in order to highlight the consequences of attacks in the physical process as well as in network traffic behaviour. Simulations data are organized in four different acquisitions for a total duration of 2 hours by considering normal scenario and multiple anomalies due to cyber and physical attacks.

Assessment of Cyber-Physical Intrusion Detection and Classification for Industrial Control Systems

“…The dataset used in this study was acquired from a hardware-in-the-loop water distribution testbed and is introduced in [13]. The physical process comprises eight tanks.…”

“…The raw features are listed in Table I. For a more detailed explanation of the dataset the reader is referred to [13].…”

“…Moreover, only in [9] several classifiers are compared and only [12] considers a scenario including both cyber attacks and physical faults. The thematically and methodologically closest works are [13] and [14]. In [13] the authors introduce the dataset which also forms the foundation for the present work.…”

“…The thematically and methodologically closest works are [13] and [14]. In [13] the authors introduce the dataset which also forms the foundation for the present work. To demonstrate a use case of the dataset, they compare several supervised classifiers for intrusion detection.…”

“…This work systematically assesses real-time cyber-physical intrusion detection and multiclass classification based on a comparison to its exclusively network data-based counterpart and evaluation of misclassifications and detection delay. Various supervised ML models are implemented and evaluated on a recent dataset of a generic ICS [13], describing several cyber attack and physical fault types based on physical process and cyber network data.…”