A Survey on Industrial Control System Testbeds and Datasets for Security Research

Design of Platforms for Experimentation in Industrial Cybersecurity

“…Given the technical difficulty to perform a security assessment on a running system placed in a critical infrastructure, scientists have created testbeds where experimental research can be made safely [10,11]. A great number of alternatives have been proposed so far [7] with differences in the sector under study, the scale and coverage of their architecture, the usage objectives, the structural and functional characteristics or their evaluation process [12]. An especially active field for the application of testbeds is that of power system infrastructures and smart grids.…”

“…The scale and coverage of the testbed will depend greatly on the simulation approach. Nevertheless, even the approaches with real physical systems often cover only a small set of communication protocols, up to three in most scenarios [7]. Among the thirty different ICS testbeds that have been analyzed in [14], the most common usage objectives identified are vulnerability analysis, education and test of defence mechanisms.…”

“…The architecture proposed in this work stands out for the diversity of systems that can be emulated, an approach also followed by laboratories such as the Multiple-Scenario Industrial Control System Testbed (MSICST), the National Institute of Standards and Technology (NIST) testbed or the University of New Orleans SCADA system [7]. However, compared to these and other previous works, the proposed testbed covers a much larger set of technologies and protocols.…”

“…Although security practices developed in the IT field in the last few decades should be taken as a starting point for developing solutions, the particularities of control systems should be considered for its successful application [6]. That is why increasing efforts have been made lately to create industrial-oriented testbeds, where researchers can perform experiments safely and evaluate security-related experiments in similar scenarios to those ones found in critical infrastructures [7]. Furthermore, these environments are also necessary for industrial cybersecurity training in critical infrastructures because of a lack of professionals with the related skills [8].…”

Cross-domain alert correlation methodology for industrial control systems

“…Conti et al provide a comprehensive survey on the testbeds, and related datasets, developed to test IDS performances on ICS environments. [64]. However, we could not have directly exploited those datasets for our work because we would have needed access to the control logic and the initial state of the logic in the captures to perform the activity tracking required by the process-aware IDS [47].…”