工控加密流量数据集

该数据集包含工业控制系统工控加密流量数据集的相关信息，如读值、写值、建立链接、关闭链接、运行控制程序、停止控制程序、控制程序上传、控制程序删除、修改PLC设置信息。 数据由TE过程的模拟程序、PLC执行的控制模拟程序、OPC UA服务端和模拟HMI的OPC UA的客户端产生。通过Wireshark抓取OpenPLC和HMI之间的加密流量。 PLC执行的控制程序使用结构化文本语言编写，通过OpenPLC的Web页面上传，在OpenPLC内核中转换为C语言并编译为可执行的控制程序。在真实工控场景中控制程序的输入是接收于传感器的测量值、主站或HMI的设定值，在仿真实现中其输入是TE过程模拟程序的输出，既10个监控变量的值，从OpenPLC的输入映射表中读取。在真实的工控场景中控制程序的输出是对执行器的调控命令或发送给从站的值，在仿真实现中其输出作为TE过程模拟程序的输入，既4个操控变量的值，写入到OpenPLC的输出映射表中。 TE过程的模拟程序使用C++语言编写，通过计算TE过程中的一些微分方程模拟TE过程，和OpenPLC运行在同一台虚拟机中，TE过程中的四个操纵变量通过直接读取OpenPLC的输出映射表设置其值，而十个观测变量通过将其直接拷贝到OpenPLC的输入映射表模拟传感器采集到的数据。 通过在PLC中建模OPC UA标准的TE信息模型，实现OPC UA服务端向HMI中实现的OPC UA客户端提供数据读写支持。模拟HMI的OPC UA客户端可以向OPC UA服务端发送所有十四个变量的读写请求，也即允许HMI的操控人员既能读写OpenPLC的输入映射表（十个观测变量），也能读写OpenPLC的输出映射表（四个操纵变量）。这种设置相较真实场景下的HMI有更高的操作自由度，其目的是采集到更丰富的流量数据样本。This dataset contains information related to an industrial control system (ICS) encrypted traffic dataset, covering read operations, write operations, link establishment, link closure, control program startup, control program shutdown, control program upload, control program deletion, and PLC setting modification. The dataset is generated by a Tennessee Eastman (TE) process simulation program, a control simulation program executed by PLC, an OPC UA server, and an OPC UA client simulating a human-machine interface (HMI). Encrypted traffic between OpenPLC and the simulated HMI is captured using Wireshark. The control programs executed by PLC are written in Structured Text (ST), uploaded via the OpenPLC web interface, converted to C language within the OpenPLC kernel, and compiled into executable control programs. In real industrial control scenarios, the inputs of the control program are measurement values received from sensors and set values from the master station or HMI. In this simulation implementation, the inputs are the outputs of the TE process simulation program, specifically the values of 10 monitored variables, which are read from the OpenPLC input mapping table. In real industrial control scenarios, the outputs of the control program are regulation commands for actuators or values sent to slave stations. In this simulation implementation, the outputs serve as the inputs of the TE process simulation program, specifically the values of 4 manipulated variables, which are written into the OpenPLC output mapping table. The TE process simulation program is written in C++, which simulates the TE process by solving a set of differential equations involved in the process. It runs on the same virtual machine as OpenPLC. The four manipulated variables in the TE process set their values by directly reading the OpenPLC output mapping table, while the ten monitored variables are copied directly into the OpenPLC input mapping table to simulate data collected by sensors. By modeling the TE information model compliant with the OPC UA standard within the PLC, the OPC UA server is enabled to provide data read/write support for the OPC UA client implemented in the simulated HMI. The OPC UA client simulating the HMI can send read and write requests for all fourteen variables to the OPC UA server, meaning that HMI operators are allowed to both read and write the OpenPLC input mapping table (ten monitored variables) and the OpenPLC output mapping table (four manipulated variables). This configuration offers higher operational freedom compared to HMIs in real-world scenarios, with the goal of collecting more diverse traffic data samples.

搜集汇总

背景与挑战

背景概述

该数据集为工业控制系统加密流量数据，通过模拟TE过程、OpenPLC和OPC UA服务端/客户端环境生成，包含读写值、程序控制等操作类型的加密流量。数据采用Wireshark抓取，适用于网络流量特征分析。